PT-2019-15947 · Minerstat · Msos

Name of the Vulnerable Software and Affected Versions: minerstat msOS versions prior to 2019-10-23 Description: The issue is related to the lack of unique SSH keys for each instance of the product. This could potentially lead to security risks. Recommendations: For versions prior to 2019-10-23,...

CVE-2019-16765

If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to...

PT-2019-4454 · Jenkins · Jenkins Jira Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JIRA Plugin versions 3.0.10 and earlier Description: The issue is related to the incorrect declaration of the scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope. This can lead to...

CVE-2019-18949

SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration...

glib2 security, bug fix, and enhancement update

2.56.4-7 - Backport patch for CVE-2019-12450 Resolves: 1722101 2.56.4-5 - Backport glib2 change needed for accountsservice dbus codegen fix Resolves: 1713081 2.56.4-4 - Back GHmac with GnuTLS for FIPS - Resolves: 1630260 2.56.4-3 - Backport per-desktop overrides - Resolves: 1715951 2.56.4-2 - Add...

Nextcloud: Improper integrity protection of server-side encryption keys

The public keys used for the server-side encryption are not integrity-protected. These can easily replaced by anyone who has access to the data-at-rest data even when the per-user-keys are enabled, as described in https://nextcloud.com/security/threat-model/. This holds true for all key types -...

CVE-2015-9520

The Easy Digital Downloads EDD Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

Design/Logic Flaw

The Easy Digital Downloads EDD Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9520

The Easy Digital Downloads EDD Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

DEBIAN-CVE-2019-16942

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has the commons-dbcp 1.4 jar in the classpath, and an attacker can find a...

UBUNTU-CVE-2019-16942

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has the commons-dbcp 1.4 jar in the classpath, and an attacker can find a...

CVE-2019-14957

The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vimsettings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository...

September 26, 2019 — KB4515871 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10 version 1903 and Windows 10 version 1909

None None...

September 24, 2019 — KB4515840 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1703

None None...

September 24, 2019 — KB4515839 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1607

None None...

September 24, 2019 — KB4515841 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1709

None None...

September 24, 2019 — KB4515842 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1803

None None...

SUSE-SU-2019:2365-2 Security update for python-Werkzeug

This update for python-Werkzeug fixes the following issues: Security issue fixed: - CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container bsc1145383...

PT-2019-14505 · Kilo · Kilo

Name of the Vulnerable Software and Affected Versions: Kilo version 0.0.1 Description: The issue is related to a heap-based buffer overflow caused by an integer overflow in a calculation involving the number of tabs in one row. Recommendations: For Kilo version 0.0.1, at the moment, there is no...

UBUNTU-CVE-2019-11748

WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities in other software, a decision was made to no longer persist these permissions. This avoids the...