June 18, 2019—KB4501371 (OS Build 17763.592)

June 18, 2019—KB4501371 OS Build 17763.592 Applies To Windows 10, version 1809, all editions Windows Server version 1809 Windows Server 2019, all editions Note Follow @WindowsUpdate to find out when new content is published to the release information dashboard. Note Starting with update KB4497934...

Node.js third-party modules: [min-http-server] Stored XSS in the filename when directories listing

I would like to report Stored XSS in module "min-http-server". It allows to inject malicious scripts in the file name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: min-http-server version: 1.0.6 npm page:...

Node.js third-party modules: [min-http-server] List any file in the folder by using path traversal.

I would like to report Path Traversal in min-http-server. It allows to list any file in another folder of web root. Module module name: min-http-server version: 1.0.6 npm page: https://www.npmjs.com/package/min-http-server Module Description 'min-http-server' is a zero-configuration, lightweight...

kernel: Faulty computation of numberic bounds in the BPF verifier

A security flaw was found in the Linux kernel in the adjustscalarminmaxvals function in kernel/bpf/verifier.c. A faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because this function mishandles 32-bit right shifts. A local unprivileged user cannot...

DEBIAN-CVE-2019-8426

skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControlMinTiltRange parameter...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.7.3), io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (1.2.6.final) +55 more potentially affected by CVE-2018-14637 via org.keycloak:keycloak-core (1.9.4.final)

org.keycloak:keycloak-core MAVEN version 1.9.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.7.3 -...

com.gitblit.fathom:fathom-security-keycloak (>=0.8.4, <=1.0.1), org.commonjava.indy.embed:indy-embedder (>=1.3.0, <=1.5.0.3) +53 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.9.8.final)

org.keycloak:keycloak-core MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.gitblit.fathom:fathom-security-keycloak =0.8.4, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0, =1.2.2 -...

com.gitblit.fathom:fathom-security-keycloak (>=0.8.4, <=1.0.1), org.commonjava.indy.embed:indy-embedder (>=1.3.0, <=1.5.0.3) +53 more potentially affected by CVE-2018-10912 via org.keycloak:keycloak-core (1.9.8.final)

org.keycloak:keycloak-core MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.gitblit.fathom:fathom-security-keycloak =0.8.4, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0, =1.2.2 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.7.0, <=0.7.1), io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.2.final, <=1.2.3.final) +51 more potentially affected by CVE-2017-2585 via org.keycloak:keycloak-core (1.9.0.final)

org.keycloak:keycloak-core MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.7.0, =1.2.2.final, =1.2.2.final, =1.2.2.final,...

org.hawkular.accounts:hawkular-accounts (>=2.0.23.final, <=2.0.39.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.23.final, <=2.0.39.final) +53 more potentially affected by CVE-2017-2585 via org.keycloak:keycloak-core (1.9.1.final)

org.keycloak:keycloak-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.23.final, =2.0.23.final, =2.0.23.final, =2.0.23.final,...

DEBIAN-CVE-2018-18445

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjustscalarminmaxvals in kernel/bpf/verifier.c mishandles 32-bit right shifts...

UBUNTU-CVE-2018-18445

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjustscalarminmaxvals in kernel/bpf/verifier.c mishandles 32-bit right shifts...

PT-2018-2983

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.14.x through 4.18.x before 4.18.13 Description The issue is caused by faulty computation of numeric bounds in the BPF verifier, which permits out-of-bounds memory accesses. This is due to the mishandling of 32-bit right...

acesso.ivv.min-agricultura.pt XSS vulnerability

Open Bug Bounty ID: OBB-654863 Description| Value ---|--- Affected Website:| acesso.ivv.min-agricultura.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

min-funabashi.jp XSS vulnerability

Open Bug Bounty ID: OBB-599999 Description| Value ---|--- Affected Website:| min-funabashi.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

min-com.com XSS vulnerability

Vulnerable URL: https://www.min-com.com/brockville-real-estate-listings.php?command=view=13" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 10898401 VIP website status:| No Coordinated Disclosure Timeline:...

PT-2018-9696

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.13 Description: The issue might allow local users to cause a denial of service. This is related to the kill something info function in kernel/signal.c, which can be affected when an unspecified architecture an...

Heap-buffer-overflow in find_minlength

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4881488118022144 Fuzzer: libFuzzerpcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x614000002c33 Crash State:...

min-vinkaelder.dk XSS vulnerability

Open Bug Bounty ID: OBB-182484 Description| Value ---|--- Affected Website:| min-vinkaelder.dk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

USN-3045-1 php5, php7.0 vulnerabilities

It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. CVE-2015-4116 ...