Security Update for Microsoft Office (Feb 2019) (macOS)

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by a vulnerability that allows remote attackers to bypass authentication to execute an arbitrary command through the protocol- compliant traffic. C Tenable...

USB Cable with Embedded Wi-Fi Controller

It's only a prototype, but this USB cable has an embedded Wi-Fi controller. Whoever controls that Wi-Fi connection can remotely execute commands on the attached computer...

USN-3889-1 webkit2gtk vulnerabilities

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

Code injection

Certain Lexmark CX, MX, X, XC, XM, XS, and 6500e devices before 2019-02-11 allow remote attackers to erase stored shortcuts...

[ASA-201902-2] firefox: multiple issues

Arch Linux Security Advisory ASA-201902-2 ========================================= Severity: Critical Date : 2019-02-06 CVE-ID : CVE-2018-18500 CVE-2018-18501 CVE-2018-18502 CVE-2018-18503 CVE-2018-18504 CVE-2018-18505 CVE-2018-18506 Package : firefox Type : multiple issues Remote : Yes Link :...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Denial Of Service (DoS)

pacemaker is vulnerable to denial of service DoS attacks. The vulnerability exists as pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service node disconnection via an unauthenticated connection...

Denial Of Service (DoS)

bind is vulnerable to denial of service DoS attacks. The vulnerability exists as named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service assertion failure and daemon exit via a DNAME record in the answer...

Privilege Escalation

java-1.7.1-ibm is vulnerable to privilege escalation attacks. The vulnerability exists as an unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries...

Denial Of Service (DoS)

foomatic is vulnerable to denial of service DoS attacks. The vulnerability exists as a heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service memory corruption and crash or possibly execute arbitra...

Sandbox Restrictions Bypass

openjdk is vulnerable to sandbox restrictions bypass. An unspecified vulnerability allows remote attacks and untrusted Java applications or applets to bypass certain Java sandbox restrictions to perform unauthorized actions...

Denial Of Service (DoS)

firefox is vulnerable to denial of service DoS attacks. The vulnerability exists as multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and...

Multiple Cross-site Scripting (XSS) Vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the 1 format, 2 negativeformat, or 3 units...

Traccar Server <= 4.2 XXE Vulnerability

Traccar is prone to an XXE vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112483...

Google Chrome PDFium has an unspecified vulnerability

Google Chrome is the United States Google Google company developed a Web browser. PDFium is one of the open source PDF rendering engine. A security vulnerability exists in PDFium in versions of Google Chrome prior to 71.0.3578.80. A remote attacker can exploit the vulnerability with the help of...

USN-3854-1: WebKitGTK+ vulnerabilities

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

Updated discount packages fix security vulnerabilities

The mkdtrimline function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted file CVE-2018-11468. DISCOUNT through version 2.2.3a is vulnerable to a Heap-based buffer-overflow in the markdown.c:isfootnote...

Thousands of Internet connected hot tubs vulnerable to remote attacks

By Waqas Weak security practices have rendered IoT devices vulnerable to hacking and all sorts of cyber-attacks. According to the research from a Buckinghamshire-based security group Pen Test Partners, hot tubs can also be hacked using an app simply because there isn’t any authentication process ...

Horner Automation Cscape CSP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Horner Automation Cscape. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

2019: The Year Ahead in Cybersecurity

2018 may have been filled with cybersecurity incidents, but the infosec community is gearing up for what the New Year will bring. From emerging cyber-threat attacks surfaces, new APT groups, and more regulations around data privacy, 2019 is set to be another big year in the cybersecurity space...