PT-2019-5407

Name of the Vulnerable Software and Affected Versions Samba versions 4.10.x through 4.10.4 Description The issue is related to a NULL pointer dereference error, which can be exploited by a remote attacker to cause a Denial of Service DoS on the AD DC LDAP server. The attacker must have directory...

UBUNTU-CVE-2019-12436

Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit...

CVE-2019-10332

A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in ConfigurationdoTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2019-10333

Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances...

PT-2019-11737 · Jenkins · Jenkins Jx Resources Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JX Resources Plugin versions 1.0.36 and earlier Description: A cross-site request forgery issue allows attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials. The vulnerability is...

CVE-2019-10333: Missing Authorization

Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances...

PT-2019-11738 · Jenkins · Jenkins Jx Resources Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JX Resources Plugin versions 1.0.36 and earlier Description: A missing permission check in the GlobalPluginConfigurationdoValidateClient method allowed users with Overall/Read access to connect to an attacker-specified Kubernetes...

PT-2019-8311 · Thehive · Thehive

Name of the Vulnerable Software and Affected Versions: TheHive versions prior to 2.13.4 TheHive versions 3.x prior to 3.3.1 Description: An improper authorization check in the User API allows users with read-only or read/write access to escalate their privileges to the administrator's privileges...

CVE-2019-10323

A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2019-10323

A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

PT-2019-11724 · Jenkins · Jenkins Artifactory Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Artifactory Plugin versions 3.2.3 and earlier Description: A missing permission check in the Jenkins Artifactory Plugin allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. The plugin...

CVE-2019-10323: Missing Authorization

A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

The vulnerability of Siemens Simatic device software, related to errors in permission management, allows a perpetrator to gain access to read and write SNMP data.

The vulnerability of Siemens Simatic device software is related to errors in permission management. Exploiting this vulnerability can allow attackers to gain access to SNMP read and write operations using built-in authentication data community string...

Information Disclosure

MySQL is vulnerable to information disclosure vulnerability. A high privileged attacker with network access via multiple protocols could compromise MySQL Server with the help of human interaction of another person along with the attacker resulting in unauthorized read access to a subset of MySQL...

PYSEC-2019-242

Capstone 3.0.4 has an out-of-bounds vulnerability SEGV caused by a read memory access in X86insnregintel in arch/X86/X86Mapping.c...

EulerOS Virtualization 3.0.1.0 : kvm (EulerOS-SA-2019-1450)

According to the versions of the kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The msrmtrrvalid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to...

Information Disclosure in Page Tree

It has been discovered backend users not having read access to specific pages still could see them in the page tree which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability...

CVE-2019-2704

Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite subcomponent: IPS Package Manager. The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successfu...

CVE-2019-2712

Vulnerability in the Oracle Commerce Platform component of Oracle Commerce subcomponent: Dynamo Application Framework. Supported versions that are affected are 11.2.0.3 and 11.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2019-2679

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...