3290 matches found
Design/Logic Flaw
Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitra...
CVE-2019-14657
Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitra...
Description of the security update for Excel 2010: October 8, 2019
Description of the security update for Excel 2010: October 8, 2019 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft Excel software if the software fails to correctly handle objects in memory. To learn more about the vulnerability, see Microsoft...
Compatibility update for installing Windows 10, version 1809: October 8, 2019
None None...
Description of the security update for SharePoint Enterprise Server 2013: October 8, 2019
None None...
Description of the security update for SharePoint Foundation 2013: October 8, 2019
Description of the security update for SharePoint Foundation 2013: October 8, 2019 Summary This security update resolves a cross-site-scripting XSS vulnerability that exists if Microsoft SharePoint Server does not ccorrectly sanitize a specially crafted web request to an affected SharePoint serve...
Compatibility update for installing Windows 10 version 1703: October 8, 2019
None None...
Compatibility update for installing Windows 10, version 1709: October 8, 2019
None None...
Description of the security update for SharePoint Foundation 2010: October 8, 2019
Description of the security update for SharePoint Foundation 2010: October 8, 2019 Summary This security update resolves a spoofing vulnerability that exists if Microsoft SharePoint Server does not correctly sanitize a specially crafted web request to an affected SharePoint server. To learn more...
CVE-2018-10912
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...
CVE-2019-16370
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900...
CVE-2019-11736
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...
CVE-2019-16370
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900...
DEBIAN-CVE-2019-16370
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900...
CVE-2019-16370
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900...
UBUNTU-CVE-2019-16370
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900...
CVE-2019-16370
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900...
Description of the security update for SharePoint Foundation 2013: September 10, 2019
Description of the security update for SharePoint Foundation 2013: September 10, 2019 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft SharePoint if the software does not check the source markup of an application package. To learn more about the...
Description of the security update for Excel 2010: September 10, 2019
Description of the security update for Excel 2010: September 10, 2019 Summary This security update resolves an information disclosure vulnerability that exists when Microsoft Excel incorrectly discloses the contents of its memory. To learn more about the vulnerability, see Microsoft Common...