PT-2019-18945

Name of the Vulnerable Software and Affected Versions Magento versions prior to 1.9.4.3 Magento Commerce versions prior to 1.14.4.3 Description The issue allows an authenticated user with administrative privileges for editing attribute sets to execute arbitrary code through custom layout...

CVE-2019-8126: Improper Restriction of XML External Entity Reference

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external...

CVE-2019-8231: Undefined Security Weakness

In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification...

CVE-2019-8090: Undefined Security Weakness

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature...

Apple iOS, iPadOS and tvOS Kernel Component Permission Logic Vulnerability (CNVD-2019-46957)

Apple iOS is an operating system developed for mobile devices.Apple tvOS is a smart TV operating system.Apple iPadOS is an operating system for iPad tablets.Kernel is one of the kernels. A security vulnerability exists in the Kernel component of Apple iOS before 13.1, iPadOS before 13.1, and tvOS...

PT-2019-18898

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.19 Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 Description A remote code execution issue exists, allowing an authenticated user with product creation privileges to craft a custom...

PT-2019-18913

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1 Description A remote code execution issue exists, allowing an authenticated user with privileges to manipulate the CMS section of the website to trigger remot...

CVE-2019-8137: Undefined Security Weakness

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate CMS section of the website can trigger remote code execution via custom layout update...

PT-2019-18879

Name of the Vulnerable Software and Affected Versions Magento 1 versions prior to 1.9.4.3 Magento 1 versions prior to 1.14.4.3 Description A remote code execution issue exists, allowing an authenticated admin user with access to product attributes to trigger remote code execution through layout...

PT-2019-18943

Name of the Vulnerable Software and Affected Versions Magento versions prior to 1.9.4.3 Magento versions prior to 1.14.4.3 Description The issue allows an authenticated user with administrative privileges to edit product attributes to execute arbitrary code through crafted layout updates...

PT-2019-18926

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1, excluding 2.3.2-p1 Description A remote code execution issue exists, allowing an authenticated user with privileges to manipulate layouts and images to inser...

CVE-2019-8150: Undefined Security Weakness

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout...

PT-2019-19193

Name of the Vulnerable Software and Affected Versions Apple macOS versions prior to 10.15 Description A logic issue was addressed with improved restrictions, which may allow a malicious application to determine kernel memory layout. Recommendations For versions prior to 10.15, update to macOS...

Apple macOS Catalina IOGraphics Component Logic Vulnerability

Apple macOS Catalina is a proprietary operating system developed by Apple Inc. for Mac computers.IOGraphics is one of the input and output graphics components. A security vulnerability exists in the IOGraphics component in Apple macOS Catalina versions prior to 10.15. An attacker can exploit this...

macOS < 10.15 Multiple Vulnerabilities

The remote host is running a version of macOS / Mac OS X that is prior to 10.15. It is, therefore, affected by multiple vulnerabilities. - An application may be able to execute arbitrary code with kernel privileges CVE-2019-8748 - Multiple issues in PHP CVE-2019-11041, CVE-2019-11042 - Processing...

IoT: a malware story

Since 2008, cyber-criminals have been creating malware to attack IoT-devices, such as routers and other types of network equipment. You will find a lot of statistics on this on Securelist, most notably, here and here. The main problem with these IoT/embedded devices is that one simply cannot...

PRODSECBUG-2446: Remote code execution via custom layout update in create product functionality

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

PRODSECBUG-2414: Remote code execution through custom layout update of the content management functionality

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

CVE-2017-5447

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Real-life social engineering. Two days in tweets

This is the write-up of my live tweets while on a recent social engineering engagement. It’s all available on my feed @ghostie I did this because I wanted to share what it's like to prep for, and work through a job, warts and all. If you can take anything away, to enhance your technique, or defen...