CVE-2019-11751

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary location such as the Windows 'Startup' folder. Note: this issue...

PT-2019-1011

Name of the Vulnerable Software and Affected Versions: podman affected versions not specified Description: The issue involves a race/corruption problem where podman failed to launch containers. Additionally, podman exec can fail with an "invalid argument" error when trying to write to cgroup.proc...

When closing and re-opening Workspace on IOS, refreshing or launching apps causes failure.

After IOS has enumerated and/or launched apps through Storefront via Netscaler Gateway, and the Workspace app is closed but not logged out, when re-opening Workspace you get failure when refreshing apps or launching new ones. Error message seen if clicking an app after re-opening workspace -...

CVE-2019-5682

NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the NVIDIA Games App where it improperly exports an Activity but does not properly restrict which applications can launch the Activity, which may lead to code execution or denial of service...

Design/Logic Flaw

NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the NVIDIA Games App where it improperly exports an Activity but does not properly restrict which applications can launch the Activity, which may lead to code execution or denial of service...

Security Bulletin: Vulnerabilities in WebSphere Application Server

Summary There are vulnerabilities in WebSphere Application Server used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof connection information which could ...

Citrix Cloud Connector Upgrade Waiting on .NET 4.7.2 Prerequisite

Navigate to Add/remove programs If you see the Connector version with anything less than version 6.8.0 The installer logs for the connector will be in the following locations: C:\ProgramData\Citrix\WorkspaceCloud\InstallLogs C:\Windows\Temp\CitrixLogs\CloudServicesSetup You may see an error relat...

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation Windows: RPCSS Activation Kernel Security Callback EoP Platform: Windows 10 1903/1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User...

Announcing the Microsoft Dynamics 365 Bounty program

One of Microsoft’s many security investments to protect customers is in the partnerships we build with the external security research community. We are excited to announce the launch of theDynamics 365 Bounty program and welcome researchers to seek out and disclose any high impact vulnerabilities...

CVE-2019-13567

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon aka the hidden web server is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a...

CVE-2019-13567

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon aka the hidden web server is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a...

PT-2019-13427

Name of the Vulnerable Software and Affected Versions Zoom Client versions prior to 4.4.53932.0709 Description The issue allows remote code execution if the ZoomOpener daemon is running but the Zoom Client is not installed or cannot be opened. An attacker can exploit this by using a maliciously...

CVE-2019-13567: Improper Neutralization of Special Elements used in an OS Command

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon aka the hidden web server is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a...

Cross-Site Request Forgery (CSRF)

react-dev-utils is vulnerable to cross-site request forgery. Local unauthenticated attackers could exploit the flawed Webserver component to execute arbitrary commands on the targeted system via the unsanitized input command to launch an editor...

CVE-2019-13449

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service continual focus grabs via a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

CVE-2019-13449: Improper Input Validation

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service continual focus grabs via a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

PT-2019-13340

Name of the Vulnerable Software and Affected Versions Zoom Client versions prior to 4.4.2 Description The issue allows remote attackers to cause a denial of service, resulting in continual focus grabs, by sending a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

CVE-2019-1855

A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform a DLL preloading attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The...

CVE-2018-19450

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX 5.4.0.1031 when parsing a launch action. An attacker can leverage this to gain remote code execution...

PT-2019-9817

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX version 5.4.0.1031 Description A command injection issue can occur when parsing a launch action in specially crafted PDF files, potentially allowing an attacker to gain remote code execution. Recommendations For Foxit...