CVE-2019-13970: Improper Neutralization of Input During Web Page Generation

In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js...

CVE-2019-13962

lavcCopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height...

System.Management.Automation subject to bypass via script debugging

Microsoft Security Advisory CVE-2019-1167: Windows Defender Application Control Security Feature Bypass Vulnerability Microsoft Security Advisory CVE-2019-1167: Windows Defender Application Control Security Feature Bypass Vulnerability Executive Summary A security feature bypass vulnerability...

EvilGnome: A New Backdoor Implant Spies On Linux Desktop Users

Security researchers have discovered a rare piece of Linux spyware that's currently fully undetected across all major antivirus security software products, and includes rarely seen functionalities with regards to most Linux malware, The Hacker News learned. It's a known fact that there are a very...

EvilGnome: A New Backdoor Implant Spies On Linux Desktop Users

Security researchers have discovered a rare piece of Linux spyware that's currently fully undetected across all major antivirus security software products, and includes rarely seen functionalities with regards to most Linux malware, The Hacker News learned. It's a known fact that there are a very...

Path traversal

In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java from the package ghidra.app.plugin.core.archive via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis...

JShielder v2.4 - Hardening Script For Linux Servers/ Secure LAMP-LEMP Deployer/ CIS Benchmark G

JSHielder is an Open Source Bash Script developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application or services. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux...

SUSE-SU-2019:1860-1 Security update for xrdp

This update for xrdp fixes the following issues: Security issues fixed: - CVE-2013-1430: When successfully logging in using RDP into an xrdp session, the file /.vnc/sesman$usernamepasswd was created. Its content was the equivalent of the user's cleartext password, DES encrypted with a known key...

The vulnerability of Cisco AMP’s security tools for end devices stems from insufficient checks on dynamically loaded modules, allowing attackers to execute arbitrary code with AMP service privileges.

The vulnerability of Cisco AMP’s security tools for end devices stems from insufficient checks on dynamically loaded modules. Exploiting this vulnerability could allow attackers to execute arbitrary code with AMP service privileges...

CVE-2019-13602

An Integer Underflow in MP4EIA608Convert in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service heap-based buffer overflow and crash or possibly have unspecified other impact via a crafted .mp4 file...

Unauthorized Access Vulnerability in Longchamp U9300W, U9507C 4G Modules

LongSun Technology Shanghai Co., Ltd. is a supplier of IoT modules and solutions. An unauthorized access vulnerability exists in the U9300W and U9507C 4G modules of Longchamp Technology. An attacker can exploit the vulnerability to obtain root privileges...

Race condition

A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules All versions , DIGSI 5 engineering software All versions V7.90, SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87,...

CVE-2019-10931

A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules All versions , DIGSI 5 engineering software All versions V7.90, SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87,...

CVE-2019-10930

Siem ens CVE-2019-10930 affects SIPROTEC 5 (CPU CP300/CP100 and CP200 variants) and related DIGSI 5 modules. A remote attacker could exploit via specially crafted packets to Port 443/TCP to upload, download or delete files in parts of the file system. Affected devices include a range of SIPROTEC ...

CVE-2019-10931: Uncaught Exception

A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules All versions , DIGSI 5 engineering software All versions V7.90, SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87,...

CVE-2019-0328

ABAP Tests Modules SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5 of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system...

Code injection

ABAP Tests Modules SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5 of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system...

Latest FinSpy Modules Lift Data from Secure Messaging Apps

The latest iOS and Android versions of the FinSpy espionage malware have been deployed in the wild, and are capable of collecting a raft of personal information such as contacts, SMS/MMS messages, emails, calendars, GPS location, photos, files in memory, phone call recordings and data – even from...

Agent Smith Malware Infects 25M Android Phones to Push Rogue Ads

Researchers are warning of a new breed of Android malware, dubbed “Agent Smith,” that they claim has infected 25 million handsets in order to replace legitimate apps with doppelgangers that display rogue ads. The malware is tied to a China-based firm, according to Check Point researchers, and is...

PT-2019-13308

Name of the Vulnerable Software and Affected Versions FlightPath versions 4.x through 5.0-x Description The issue allows directory traversal and Local File Inclusion through the form include parameter in an "index.php?q=system-handle-form-submit" POST request. This is due to an include once in th...