OPENSUSE-SU-2019:2015-1 Security update for vlc

This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow bsc1138354. - CVE-2019-5459: Fixed an integer underflow bsc1143549. - CVE-2019-5460: Fixed a double free bsc1143547. - CVE-2019-12874: Fixed a double free in...

Security update for teeworlds (moderate)

openSUSE Security Update: Security update for teeworlds Announcement ID: openSUSE-SU-2019:1999-1 Rating: moderate References: 1112910 1131729 Cross-References: CVE-2018-18541 CVE-2019-10877 CVE-2019-10878 CVE-2019-10879 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes four...

New Relic: User can run monitors at private locations, which he has no access to

@skavans discovered that insufficient validation was performed when configuring Synthetics monitors allowing deployment to arbitrary private locations with knowledge of the location ID: POST /accounts//validation.json HTTP/1.1 Host: synthetics.newrelic.com...

Cross site request forgery (csrf)

The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery CSRF vulnerability...

CVE-2018-18573

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files e.g., omitting .php and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=newprodu...

OpenEMR Command Injection Vulnerability (CNVD-2019-28410)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A command injection vulnerability exists in OpenEMR 5.0.1 and earlier versions, which can be exploited by an authenticated attacker to execute arbitrary commands on the host system via the "Scanne...

CVE-2019-15105

An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

PT-2019-6433 · Live Networks +2 · Live555 +2

Name of the Vulnerable Software and Affected Versions: Live555 versions prior to 2019.08.16 Description: The issue is related to a Use-After-Free error in the GenericMediaServer::createNewClientSessionWithId function, which can generate the same client session ID in succession. This is mishandled...

PT-2019-13728 · Evolution Cms · Evolution Cms

Name of the Vulnerable Software and Affected Versions: Evolution CMS versions 2.0.x Description: The issue allows for XSS via a description and new category location in a template. The vendor states that the behavior is consistent with the access policy in the administration panel. Recommendation...

Ubuntu 19.04 : MariaDB vulnerabilities (USN-4070-3)

USN-4070-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2758, CVE-2019-2805, CVE-2019-2628, CVE-2019-2627, CVE-2019-2614 in MariaDB 10.3. Ubuntu 19.04 has been updated to MariaDB 10.3.17. In additio...

Ubuntu 18.04 LTS : MariaDB vulnerabilities (USN-4070-2)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4070-2 advisory. USN-4070-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2019-2737, CVE-2019-2739, CVE-2019-2740,...

Product update: Virtuozzo 7.0 Update 11 Hotfix 1 (7.0.11-303)

The Hotfix 1 for Virtuozzo 7.0.11 adds a new feature...

Design/Logic Flaw

Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions...

CVE-2019-14987

Adive Framework up to version 2.0.7 is affected by a Cross-Site Scripting (XSS) vulnerability in the Create New Table and Create New Navigation Link functionalities. Root cause indicated as insufficient validation of client-side data in the web application (CNVD reference aligns). Impact per NVD ...

CVE-2019-14987

Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions...

OPENSUSE-SU-2019:1845-1 Security update for zstd

This update for zstd to version 1.4.2 fixes the following issues: Security issues fixed: - CVE-2019-11922: Fixed race condition in one-pass compression functions that could allow out of bounds write boo1142941. Non-security issues fixed: - Added --no-compress-literals CLI flag to enable or disabl...

CB TAU Threat Intelligence Notification: Smominru Botnet Leverages New Attack Techniques

Carbon Black’s Threat Analysis Unit TAU and CB ThreatSight discovered the resurgence of a previously active crypytomining botnet campaign called Smominru. This campaign has evolved since its original discovery in the latter half of 2017, leveraging new techniques including LOLbins, polymorphic...

Fedora 30 : kernel / kernel-headers / kernel-tools (2019-7aecfe1c4b)

The 5.2.5 stable kernel update contains a number of important fixes across the tree. This should also fix the black screen issue that several i915 users were hitting with 5.2.4. ---- The 5.2.4 kernel rebase contains new features and hardware support, and a number of important fixes across the tre...

FreeBSD : Gitlab -- Multiple Vulnerabilities (1cd89254-b2db-11e9-8001-001b217b3468)

Gitlab reports : GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...