Intel Firmware Vulnerabilities - Lenovo Support US

Lenovo Security Advisory: LEN-26294 Potential Impact: Privilege escalation, denial of service Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2019-0119 , CVE-2019-0120 , CVE-2019-0126 Summary Description: Potential security vulnerabilities in Intel firmware may allow for...

PT-2019-2205 · Intel · Intel Active Management Technology

Name of the Vulnerable Software and Affected Versions: Intel Active Management Technology versions prior to 11.8.65 Intel Active Management Technology versions prior to 11.11.65 Intel Active Management Technology versions prior to 11.22.65 Intel Active Management Technology versions prior to...

Intel® NUC Advisory

Summary: A potential security vulnerability in system firmware for Intel® NUC may allow escalation of privilege, denial of service, and/or information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2019-11094 Description...

CVE-2018-7064

A reflected cross-site scripting XSS vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session...

PT-2019-12518 · Dave Gamble · Cjson

Name of the Vulnerable Software and Affected Versions: cJSON versions prior to 1.7.11 Description: The issue allows out-of-bounds access, related to multiline comments. Recommendations: For versions prior to 1.7.11, update to version 1.7.11 or later to resolve the issue...

Security update for GraphicsMagick (moderate)

openSUSE Security Update: Security update for GraphicsMagick Announcement ID: openSUSE-SU-2019:1355-1 Rating: moderate References: 1132053 1132054 1133202 1133203 1133498 1133501 Cross-References: CVE-2019-11008 CVE-2019-11009 CVE-2019-11473 CVE-2019-11474 CVE-2019-11505 CVE-2019-11506 Affected...

PT-2019-9388

Name of the Vulnerable Software and Affected Versions Open XDMoD versions prior to 7.5.0 Description An issue exists due to a weak password reset mechanism, allowing for an authentication bypass, which can lead to account takeover. In a plausible scenario where the attacker is aware that the vict...

PT-2019-11719 · Jenkins · Jenkins Sitemonitor Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SiteMonitor Plugin version 0.5 and earlier Description: The issue concerns the Jenkins SiteMonitor Plugin, which unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. This means that the plugin...

PT-2019-9130 · Gnu · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 versions prior to 5.3.1.6 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML in specific files, namely adm/boardgroup form...

PT-2019-18311 · Foxit · Foxit Studio Photo

Name of the Vulnerable Software and Affected Versions: Foxit Studio Photo version 3.6.6.779 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. T...

PT-2019-1871 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.15 and prior Description: The issue is related to a lack of access control in the MySQL Server component, specifically in the Server: Optimizer subcomponent. This allows a high-privileged attacker with network access...

PT-2019-2187 · Atftp +3 · Atftp +3

Name of the Vulnerable Software and Affected Versions: atftp version 0.7.1 Description: The issue is related to the thread list mutex mutex in the atftpd component of atftp. It does not properly lock the mutex before assigning the current thread data structure, leading to a potential denial of...

PT-2019-12164 · Postgresql · Sequelize

Name of the Vulnerable Software and Affected Versions: Sequelize versions prior to 5.3.0 Description: The issue arises from the improper handling of backslashes in string literals, potentially allowing attackers to inject SQL statements. This is due to the PostgreSQL option standard conforming...

PT-2019-5442 · Adobe +1 · Flash Player +1

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 32.0.0.156 and earlier Description: The issue is related to a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution, allowing a remote attacker to bypass security restrictions...

Security update for znc (low)

openSUSE Security Update: Security update for znc Announcement ID: openSUSE-SU-2019:1166-1 Rating: low References: 1130360 Cross-References: CVE-2019-9917 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 An update tha...

openSUSE: Security Advisory for openwsman (openSUSE-SU-2019:1111-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2019-17847 · Overit · Overit Geocall

Name of the Vulnerable Software and Affected Versions: OverIT Geocall versions prior to 6.3 build 2:346977 Description: A directory traversal issue was discovered in the log-management component. Recommendations: For OverIT Geocall versions prior to 6.3 build 2:346977, update to a version that...

Stack overflow

A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions...

KinagaCMS vulnerable to cross-site scripting

Overview KinagaCMS is an opensource Contents Management System CMS. KinagaCMS uses the old version of Bootstrap thus inherits multiple cross-site scripting vulnerabilities CWE-79: CVE-2018-14040, CVE-2018-14041, CVE-2019-8331 existed in Bootstrap. Project Kinaga reported this vulnerability to IPA...

Intel CSME, Server Platform Services, Trusted Execution Engine and Intel Active Management Technology Vulnerabilities - US

Lenovo Security Advisory: LEN-25083 Potential Impact: Privilege escalation, denial of service, information disclosure Severity: High Scope of Impact: Industry-wideF CVE Identifier: CVE-2018-12188, CVE-2018-12189, CVE-2018-12190, CVE-2018-12191, CVE-2018-12192, CVE-2018-12199, CVE-2018-12198,...