CVE-2018-18497

Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This...

CVE-2018-18495

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions...

openSUSE Security Update : libqt5-qtbase (openSUSE-2019-265)

This update for libqt5-qtbase provides the following fixes : Security issues fixed : - CVE-2018-15518: Fixed double free in QXmlStreamReader bsc1118595 - CVE-2018-19873: Fixed Denial of Service on malformed BMP file in QBmpHandler bsc1118596 Non-security issues fixed : - Fix dynamic loading of...

Microsoft Windows 7 Dynamic Link Library Unsafe Loading Vulnerability

Windows 7 is an operating system developed by Microsoft with the kernel version number Windows NT 6.1. Microsoft Windows 7 suffers from an insecure loading of dynamic link libraries vulnerability. An attacker can exploit this vulnerability to execute arbitrary code via specially crafted DLL files...

Microsoft Teams Dynamic Link Library Unsafe Loading Vulnerability

Microsoft Teams is a unified communications platform that combines continuous workplace chat, video conferencing, file storage and application integration. An unsafe loading of dynamic link libraries vulnerability exists in the Microsoft Teams installer. An attacker could exploit the vulnerabilit...

JVN#69181574: Windows 7 may insecurely load Dynamic Link Libraries

In standard DLL files provided by Windows 7, there are some DLL files read from the same directory where the program resides when executing the program CWE-427. Microsoft states that the root cause of this vulnerability is "Application Directory App Dir DLL planting" , thus there is no plan to...

Security update for libqt5-qtbase (moderate)

openSUSE Security Update: Security update for libqt5-qtbase Announcement ID: openSUSE-SU-2019:0265-1 Rating: moderate References: 1096328 1099874 1108889 1118595 1118596 1120639 Cross-References: CVE-2018-15518 CVE-2018-19873 Affected Products: openSUSE Leap 15.0 An update that solves two...

Cisco Unified Communications Manager Access Disclosure

The vulnerability of the Cisco Unified Communications Manager web interface relates to insufficient protection for saved passwords during the loading of configuration pages. Exploiting this vulnerability could allow a malicious actor to gain access to protected information remotely...

CVE-2019-9116

DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or api-ms-win-core-localization-l1-2-1.dll file may be loaded if a victim uses sublimetext.exe to open a .txt file within an attacker's...

February 21, 2019—KB4491101 (OS Build 10240.18135)

None None...

Juniper Networks’ Junos Space Unlimited File Upload

The vulnerability of the Juniper Networks Junos Space network resource management platform is related to the ability to load files of a malicious nature without limitation. Exploiting this vulnerability allows a remote attacker to load malicious files into the system...

February 19, 2019—KB4486565 (Preview of Monthly Rollup)

None None...

Description of the security update for the vulnerabilities in Windows Embedded POSReady 2009: February 12, 2019

Description of the security update for the vulnerabilities in Windows Embedded POSReady 2009: February 12, 2019 Notice This update was rereleased February 15, 2019 to address a known issue that occurred when you installed the original February 12, 2019 version of the update. Summary This security...

SUSE SLES11 Security Update : python-numpy (SUSE-SU-2019:13951-1)

This update for python-numpy fixes the following issues : Security issue fixed : CVE-2019-6446: Set allowpickle to false by default to restrict loading untrusted content bsc1122208. With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing...

February 12, 2019—KB4487017 (OS Build 17134.590)

None None...

APSB19-11 Security update available for the Adobe Creative Cloud Desktop Application

Adobe has released a security update for the Creative Cloud Desktop Application installer for Windows. This update resolves an insecure library loading vulnerability in the installer that could lead to privilege escalation...

Volatility Workbench - A GUI For Volatility Memory Forensics

Volatility Workbench is a graphical user interface GUI for the Volatility tool. Volatility is a command line memory analysis and forensics tool for extracting artifacts from memory dumps. Volatility Workbench is free, open source and runs in Windows. It provides a number of advantages over the...

UBUNTU-CVE-2019-7653

The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts...

ALPINE-CVE-2019-7577

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDLLoadWAVRW in audio/SDLwave.c...

Ansible Configuration Management Path Traversal

The vulnerability of the Ansible configuration management system lies in the reading of the ansible.cfg file from the working directory. This file’s location can be altered, allowing the attacker to point it to a plugin or module that is under their control. Exploiting this vulnerability could...