Intel CSME, Server Platform Services, Trusted Execution Engine and Intel Active Management Technology Vulnerabilities - US

Lenovo Security Advisory: LEN-25083 Potential Impact: Privilege escalation, denial of service, information disclosure Severity: High Scope of Impact: Industry-wideF CVE Identifier: CVE-2018-12188, CVE-2018-12189, CVE-2018-12190, CVE-2018-12191, CVE-2018-12192, CVE-2018-12199, CVE-2018-12198,...

PT-2019-10238 · Podofo +5 · Podofo +5

Name of the Vulnerable Software and Affected Versions: PoDoFo version 0.9.6 Description: An issue was discovered in PoDoFo where there is an attempted excessive memory allocation in PoDoFo::podofo calloc when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder. Recommendations: For PoDoF...

Denial of Service in mqtt-packet

Versions of mqtt-packet prior to 3.4.6, or 4.x prior to 4.0.5 are affected by a denial of service vulnerability wherein specific sequences of MQTT packets can crash the application. Recommendation Version 3.x: Update to version 3.4.6 or later. Version 4.x: Update to version 4.0.5 or later...

Security update for libu2f-host (low)

openSUSE Security Update: Security update for libu2f-host Announcement ID: openSUSE-SU-2019:0199-1 Rating: low References: 1124781 Cross-References: CVE-2018-20340 Affected Products: openSUSE Leap 42.3 An update that fixes one vulnerability is now available. Description: This update for libu2f-ho...

PT-2019-19010 · Hdf +3 · Hdf5 +3

Name of the Vulnerable Software and Affected Versions: HDF5 versions prior to 1.10.5 Description: A buffer overflow issue in the HDF5 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file. Recommendations: For versions...

GHSA-H466-J336-74WX Prototype Pollution in mpath

Versions of mpath before 0.5.1 are vulnerable to prototype pollution. Provided certain input mpath can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation Update to version 0.5.1 or later...

Security update for MozillaFirefox (important)

openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-2019:0132-1 Rating: important References: 1122983 Cross-References: CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilities is now...

PT-2019-12209 · Kubernetes +1 · Kubernetes +1

Name of the Vulnerable Software and Affected Versions: Kubernetes versions 1.12.0 through 1.12.4 Kubernetes version 1.13.0 Description: The issue concerns the rest.AnonymousClientConfig method, which is supposed to return a copy of the provided config with credentials removed. However, in the...

PT-2019-1675 · Red Hat +5 · Elfutils +6

Name of the Vulnerable Software and Affected Versions: elfutils version 0.175 Description: A heap-based buffer over-read was discovered in the read srclines function in dwarf getsrclines.c in libdw in elfutils. This issue can be exploited by a crafted input, causing segmentation faults and leadin...

PT-2019-17974 · Libiec61850 +1 · Libiec61850 +1

Name of the Vulnerable Software and Affected Versions: libIEC61850 version 1.3.1 Description: The issue is related to memory leaks in the Memory malloc and Memory calloc functions located in hal/memory/lib memory.c, which are called from several files including mms/iso mms/common/mms value.c,...

PT-2019-7859 · Fedora · Bodhi

Name of the Vulnerable Software and Affected Versions: Bodhi versions 2.9.0 and lower Description: The issue is related to cross-site scripting, which can result in code injection due to incorrect validation of bug titles. Recommendations: For Bodhi versions 2.9.0 and lower, update to a version...

GHSA-CF66-XWFP-GVC4 Missing Origin Validation in webpack-dev-server

Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

PT-2019-9958 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 8.0.2 Description: A reflected cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to the "public/notice.php" endpoint. Recommendations: For Dolibarr version...

PT-2018-9595 · Cebe · Cebe Markdown Parser

Name of the Vulnerable Software and Affected Versions: cebe markdown parser versions 1.2.0 and earlier Description: The issue allows a maliciously crafted script to be executed, potentially resulting in the loss of user data and sensitive user information. This can be exploited by crafting a thre...

openSUSE: Security Advisory for pdns-recursor (openSUSE-SU-2018:4151-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Security vulnerability affects the Report Builder that is shipped with Jazz Reporting Service (CVE-2018-1639)

Summary There is a security vulnerability in the Report Builder shipped with Jazz Reporting Service. Vulnerability Details CVEID: CVE-2018-1639 DESCRIPTION: The Report Builder of Jazz Reporting Service could allow an authenticated user to obtain sensitive information beyond its assigned privilege...

PT-2018-2287 · Microsoft · Windows Server 2008 +3

Name of the Vulnerable Software and Affected Versions: Windows Server 2008 Windows 7 Windows Server 2008 R2 Description: The issue is caused by a buffer overflow in the memory of the Win32k component Win32k.sys in Windows operating systems. This can allow an attacker to execute arbitrary code usi...

PT-2018-14822 · FFmpeg · Libav

Name of the Vulnerable Software and Affected Versions: Libav version 12.3 Description: The issue is related to an invalid memory access in the vc1 decode frame function in libavcodec/vc1dec.c, which can be exploited by attackers to cause a denial-of-service via a crafted aac file. Recommendations...

Command Injection in apex-publish-static-files

Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later...

openSUSE: Security Advisory for Recommended (openSUSE-SU-2018:1421-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...