CVE-2019-12410

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

Design/Logic Flaw

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

PYSEC-2019-196

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

Resources for Measuring Cybersecurity

Kathryn Waldron at R Street has collected all of the different resources and methodologies for measuring cybersecurity...

CVE-2019-17627

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

Authentication flaw

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

CVE-2019-17627

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

Buffer overflow

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

Input validation

Improper file permission in software installer for IntelR Smart Connect Technology for IntelR NUC may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2019-14570

The CVE-2019-14570 issue is a memory corruption vulnerability in Intel NUC system firmware that could allow a local attacker with user access to escalate privileges, cause a DoS, or disclose information. Affected products include Intel NUC 8 Mainstream Game Kit/Mini PC, NUC Board DE3815TYBE (H269...

UNIX Co-Founder Ken Thompson's BSD Password Has Finally Been Cracked

A 39-year-old password of Ken Thompson, the co-creator of the UNIX operating system among, has finally been cracked that belongs to a BSD-based system, one of the original versions of UNIX, which was back then used by various computer science pioneers. In 2014, developer Leah Neukirchen spotted a...

TIBCO Software Spotfire Analytics Platform for AWS Marketplace and TIBCO Software Enterprise Runtime for R-Server Edition Input Validation Error Vulnerabilities

TIBCO Software Spotfire Analytics Platform for AWS Marketplace and TIBCO Software Enterprise Runtime for R-Server Edition are products of TIBCO Software, Inc. TIBCO Software Spotfire Analytics Platform for AWS Marketplace is a platform for visualizing and analyzing data for the cloud application...

TIBCO Security Advisory: September 17, 2019 - TIBCO Enterprise Runtime for R Server -2019-11211

TIBCO Enterprise Runtime for R Server Running On Linux With Containerized TERR Service Vulnerable To Remote CodeExecution Original release date: September 17, 2019 Last revised: CVE-2019-11211 Source: TIBCO Software Inc. TIBCO Enterprise Runtime for R Server Running On Linux With Containerized TE...

r-core.co.jp Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-967775 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting r-core.co.jp website and its...

ICSA-19-253-03_Siemens Industrial Products (Update P)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Industrial Products Vulnerabilities: Excessive Data Query Operations in a Large Data Table, Integer Overflow or Wraparound, Uncontrolled Resource Consumption 2. UPDATE INFORMATION...

CVE-2019-0173

Authentication bypass in the web console for IntelR Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access...

Authentication flaw

Authentication bypass in the web console for IntelR Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access...

Input validation

Improper permissions in the software installer for IntelR Authenticate before 3.8 may allow an authenticated user to potentially enable escalation of privilege via local access...

NewStart CGSL MAIN 5.04 : qemu-kvm Multiple Vulnerabilities (NS-SA-2019-0005)

The remote NewStart CGSL host, running version MAIN 5.04, has qemu-kvm packages installed that are affected by multiple vulnerabilities: - Quick Emulator QEMU, compiled with the PC System Emulator with multiboot feature support, is vulnerable to an OOB r/w memory access issue. The issue could occ...

GHSA-FP5J-3FPF-MHJ5 Sensitive data written to disk unencrypted in Spark

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk controlled by spark.maxRemoteBlockSizeFetchToMem; in SparkR, using parallelize; in Pyspark, using...