CVE-2019-10990

Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files...

The vulnerability of the SMB server’s configuration file smb.conf, which is part of the Samba networking software package, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the SMB server’s configuration file smb.conf in the Samba networking software package is related to deficiencies in pathname validation for restricted access directories. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized...

The vulnerability of Microsoft Lync Server’s messaging server, related to the lack of protection for service data, allows attackers to disclose protected information.

The vulnerability of Microsoft Lync Server’s messaging server is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

The vulnerability of the Windows operating system’s kernel allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Windows operating system’s kernel is related to memory initialization errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created application...

The vulnerability of the FortiOS operating system, related to the lack of protection for service data, allows attackers to disclose the protected information.

The vulnerability of the FortiOS operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

The vulnerability of the application configuration mechanism of Cisco Firepower Threat Defense software allows attackers to gain access to protected information.

The vulnerability of the application configuration mechanism of Cisco Firepower Threat Defense microprogramming network interfaces arises due to errors in application identification. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected...

The vulnerability of NVIDIA GeForce, Quadro, and Tesla graphics processors’ software allows attackers to disclose protected information.

The vulnerability of NVIDIA GeForce, Quadro, and Tesla graphics processors relates to the lack of protection for service data. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability of the Level 3 Maintenance Functions component of the Oracle Retail Convenience Store Back Office software allows a perpetrator to gain access to protected information, alter file access rights, or cause partial service interruption.

The vulnerability of the Level 3 Maintenance Functions component of Oracle Retail Convenience Store Back Office software is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain access to protected information, modify file access rights, or cause...

The vulnerability of the Windows Graphics component of the Windows operating system allows attackers to disclose protected information.

The vulnerability of the Windows Graphics component of the Windows operating system is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

The vulnerability of the Windows Graphics component of the Windows operating system allows attackers to disclose protected information.

The vulnerability of the Windows Graphics component of the Windows operating system is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

The vulnerability of the Microsoft Outlook iOS client stems from insufficient validation of input data. This allows attackers to execute cross-site scripting attacks and compromise the integrity of the protected information.

The vulnerability of the Microsoft Outlook iOS client exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute cross-site scripting attacks and compromise the integrity of protected information...

Buffer overflow

An issue was discovered in the Texas Instruments TI TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory XOM implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in XOM-protected flash...

The vulnerability of the URL parser in the Node.js library allows a hacker to gain unauthorized access to protected data.

The vulnerability of Node.js’s URL parser lies in errors during the processing of HTTP packets. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected data through HTTP requests...

Zebra Industrial Printers

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Low skill level to exploit Vendor: Zebra Equipment: Industrial Printers Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to send specially crafted packets...

Adobe Acrobat Reader DC Protected View Text Copy Out-Of-Bounds Access Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

The vulnerability of Google Chrome’s browser-specific page extraction method allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Google Chrome web browser’s page extraction mechanism is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information through a specially...

PT-2019-2990 · Microsoft · Windows Defender

Name of the Vulnerable Software and Affected Versions: Windows Defender affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the MpSigStub.exe file for Defender, allowing file deletion in arbitrary locations. To exploit this, an attacker...

The vulnerability of the performance optimization function in Lazy FPU context switching of Intel Core processors lies in the lack of protection for service data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the performance optimization function in Lazy FPU context switching of Intel Core processors is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

keepalived: Improper pathname validation allows for overwrite of arbitrary filenames via symlinks

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protectedsymlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or...

The vulnerability in the fs/ext4/extents.c file of the Linux operating system allows a hacker to disclose protected information.

The vulnerability in the fs/ext4/extents.c file of the Linux operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...