CVE-2019-13553

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely...

CVE-2016-5202

browser/extensions/api/dial/dialregistry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase call, which causes the erase operation to access data that that erase operation will destroy...

CVE-2016-5202

Removed by vendor...

Dnsmasq Information Disclosure Vulnerability (CNVD-2019-39404)

Dnsmasq is a lightweight, easy-to-configure DNS forwarder and DHCP server. An information disclosure vulnerability exists in Dnsmasq, which arises from errors in configuration and other errors in the operation of a network system or product, and can be exploited by an unauthorized attacker to...

foreman: Recover of plaintext password or token for the compute resources

It was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control over compu...

AVEVA Vijeo Citect and Citect SCADA (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit --------- Begin Update A Part 1 of 5 --------- Vendor: AVEVA and Schneider Electric Equipment: AVEVA’s Vijeo Citect and Citect SCADA; Schneider Electric’s Power SCADA Operation --------- End Update A Part...

Cross-Site Scripting (XSS)

encore/laravel-admin is vulnerable to cross-site scripting XSS. It is possible because it does not properly handle the "Operation Log" screen, allowing an attacker to inject arbitrary script through Slug or Name parameters on the Roles screen...

CVE-2019-17433

z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen...

CVE-2019-17433

z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen...

Code injection

z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen...

CVE-2019-17433

Summary: CVE-2019-17433 affects z-song laravel-admin 1.7.3. An XSS vulnerability exists on the Roles screen (Slug/Name fields) due to mishandling on the “Operation log” screen. What’s affected: The Laravel-Admin UI component used for managing Roles in z-song’s laravel-admin package (version 1.7.3...

CVE-2019-17433

z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen...

Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe vulnerabilities could allow an attacker to execute arbitrary co...

ALPINE-CVE-2019-17349

An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service infinite loop involving a LoadExcl or StoreExcl operation...

DEBIAN-CVE-2019-17344

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates...

Design/Logic Flaw

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates...

CVE-2019-17344

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates...

libyal libfwsi Buffer Overflow Vulnerability

libyal libfwsi is a library for accessing the Windows Shell. The 'libfwsiextensionblockcopyfrombytestream' function in the libfwsiextensionblock.c file in versions prior to libyal libfwsi 20191006 has a Buffer overflow vulnerability, which arises when a networked system or product performs an...

October 3, 2019—KB4524154 (Monthly Rollup)

None None...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - The All-Stars | McAfee Blogs

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – The All-Stars John Fokker · OCT 02, 2019 Episode 2: The All-Stars Analyzing Affiliate Structures in Ransomware-as-a-Service Campaigns This is the second installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi...