CVE-2019-11132

CVE-2019-11132 : Cross-site scripting vulnerability in the Intel Active Management Technology (AMT) subsystem prior to firmware versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 could allow a privileged user to escalate privileges via network access. The issue is documented in multiple sources (NV...

Drupal Core SA-CORE-2019-009 Denial of Service Vulnerability

Description Drupal Core is prone to a remote denial-of-service vulnerability. An attacker can leverage this issue to cause denial-of-service condition. The following versions are vulnerable: Drupal 8.7.x versions prior to 8.7.11. Drupal 8.8.x versions prior to 8.8.1. Technologies Affected Drupal...

TYPO3 CVE-2019-19850 SQL Injection Vulnerability

Description TYPO3 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

Input validation

Improper input validation in firmware for IntelR NUCR may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2019-11157

Improper conditions check in voltage settings for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access...

AppXSvc 17763 Arbitrary File Overwrite

Exploit Title: AppXSvc 17763 - Arbitrary File Overwrite DoS Date: 2019-10-28 Exploit Author: Gabor Seljan Vendor Homepage: https://www.microsoft.com/ Version: 17763.1.amd64fre.rs5release.180914-1434 Tested on: Windows 10 Version 1809 for x64-based Systems CVE: CVE-2019-1476 Summary: AppXSvc...

kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory...

CVE-2019-11157

Improper conditions check in voltage settings for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access...

IBM Spectrum Scale CVE-2019-4665 Cross Site Scripting Vulnerability

Description IBM Spectrum Scale is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication...

SQLite Multiple Security Vulnerabilities

Description SQLite is prone to the following security vulnerabilities. 1. A denial-of-service vulnerability 2. A security vulnerability An attacker can exploit these issues to cause the application to crash, denying service to legitimate users. Technologies Affected SQLite SQLite 1.2.2 SQLite...

CVE-2019-17437

An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9....

Symantec Norton Password Manager CVE-2019-19545 Cross-Origin Security Bypass Vulnerability

Description Symantec Norton Password Manager is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Versions prior to Symantec Norton Password Manager...

CVE-2019-18347

A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another possibly privileged user. Affected database fields include...

Redhat KeyCloak CVE-2019-14909 Authentication Bypass Vulnerability

Description Redhat KeyCloak is prone to an authentication-bypass vulnerability. Remote attackers can exploit this issue to bypass the authentication mechanism and gain unauthorized access. Technologies Affected Redhat keycloak 7.0.0 Redhat keycloak 7.0.1.Final Recommendations Block external acces...

CVE-2019-19362

An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. The vendor states that it was later fixed. Upon login, every communication is saved within Windows main memory. When a user logs out or deletes conversation history but does not exit the...

CVE-2019-10213

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator b...

CVE-2019-10213

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator b...

Pivotal RabbitMQ CVE-2019-11287 Remote Denial of Service Vulnerability

Description Pivotal RabbitMQ is prone to a remote denial-of-service vulnerability because it fails to sufficiently bounds check user supplied data. Attackers can exploit this issue to crash the affected application, denying service to legitimate users. Technologies Affected Pivotal RabbitMQ for P...

CVE-2019-5509

ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when successfully exploited could allow an unauthenticated remote attacker to enable and use a privileged user account...

CVE-2019-5509

ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when successfully exploited could allow an unauthenticated remote attacker to enable and use a privileged user account...