Description of the security update for Office Online Server: January 8, 2019

None None...

Missing Origin Validation in webpack-dev-server

Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

GHSA-CF66-XWFP-GVC4 Missing Origin Validation in webpack-dev-server

Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

Fedora 29 : python-markdown2 (2018-6a8028084d)

python-markdown2 2.3.6 - pull 282 Add TOC depth option - pull 283 Fix to add TOC html to output via CLI - pull 284 Do not remove anchors in safemode - pull 288 fixing cuddled-lists with a single list item - pull 292 Fix Wrong rendering of last list element - pull 295 link-patterns fix - pull 300...

SUSE Linux SMT Authentication Bypass

The vulnerability of the SUSE Linux Subscription Management Tool SMT is related to deficiencies in the authentication process when the HOST header is used. Exploiting this vulnerability could allow a malicious actor to remotely replace the server...

Mobile Menace Monday: Is Fuchsia OS the end of Android?

It’s no secret that every year Google announces a new Android version. This time though, recent Google documents state that the next major Android version will be Android Q and not Android 9.1 Pie. In parallel, Google is also developing an operating system called Fuchsia that’s supposedly going t...

ghostscript: Incorrect free logic in pagedevice replacement (699664)

It was discovered that the ghostscript device cleanup did not properly handle devices replaced with a null device. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted...

Description of the Security Only update for .NET Framework 4.5.2 for Windows 8.1 and Server 2012 R2 (KB 4470491)

Description of the Security Only update for .NET Framework 4.5.2 for Windows 8.1 and Server 2012 R2 KB 4470491 Applies to: Microsoft .NET Framework 4.5.2 Summary This security update resolves a vulnerability in Microsoft .NET Framework that could allow remote code execution when Microsoft .NET...

Description of the Security and Quality Rollup for .NET Framework 3.5 for Windows 7 SP1 and Server 2008 R2 SP1 (KB 4470641)

Description of the Security and Quality Rollup for .NET Framework 3.5 for Windows 7 SP1 and Server 2008 R2 SP1 KB 4470641 Applies to: Microsoft .NET Framework 3.5 Summary This security update resolves a vulnerability in Microsoft .NET Framework that could allow remote code execution when Microsof...

Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: October 9, 2018

Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: October 9, 2018 Summary This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Key changes include: Improves the efficiency of evaluating newer updates, thereby...

Microsoft building Chrome-based browser to replace Edge on Windows 10

It is no secret how miserably Microsoft's 3-year-old Edge web browser has failed to compete against Google Chrome despite substantial investment and continuous improvements. According to the latest round of tech rumors, Microsoft has given up on Edge and reportedly building a new Chromium -based...

Microsoft building Chrome-based browser to replace Edge on Windows 10

It is no secret how miserably Microsoft's 3-year-old Edge web browser has failed to compete against Google Chrome despite substantial investment and continuous improvements. According to the latest round of tech rumors, Microsoft has given up on Edge and reportedly building a new Chromium-based w...

Entropy Backdoor

Overview All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte val...

UBUNTU-CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...

End of support for Office 2013

End of support for Office 2013 Support for Office 2013 ended on April 11, 2023 and there will be no extension and no extended security updates. All of your Office 2013 apps will continue to function. However, you could expose yourself to serious and potentially harmful security risks.Buy or try...

Description of the security update for Office 2016: November 13, 2018

None None...

CVE-2018-7910: Improper Authentication

Some Huawei smartphones ALP-AL00B 8.0.0.118DC00, ALP-TL00B 8.0.0.118DC01, BLA-AL00B 8.0.0.118DC00, BLA-L09C 8.0.0.127C432, 8.0.0.128C432, 8.0.0.137C432, BLA-L29C 8.0.0.129C432, 8.0.0.137C432 have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the...

CVE-2018-19072

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/app has 0777 permissions, allowing local users to replace an archive file within that...

Multiple Huawei phone authentication bypass vulnerabilities

ALP-AL00B\BLA-AL00B and others are smartphones launched by Huawei. Authentication bypass vulnerability exists in several Huawei phones, which can be exploited by an attacker with access to a user's phone to replace the startup program, allowing the attacker to access information in the phone and...

PT-2018-14785

Name of the Vulnerable Software and Affected Versions Foscam C2 versions System Firmware 1.11.1.8 and Application Firmware 2.72.1.32 Opticam i5 versions System Firmware 1.5.2.11 and Application Firmware 2.21.1.128 Description An issue allows local users to replace an archive file within the...