polkit: Temporary auth hijacking via PID reuse and non-atomic fork

A vulnerability was found in polkit. When authentication is performed by a non-root user to perform an administrative task, the authentication is temporarily cached in such a way that a local attacker could impersonate the authorized process, thus gaining access to elevated privileges...

RHEL 7 : polkit (RHSA-2019:2699)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2699 advisory. The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privilege...

Adobe Flash Player PSDK Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Flash Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Rockwell Automation Stratix 5100 Wireless Access Point and Workgroup Bridge < 15.4 Reusing a Nonce (ICSA-17-299-02)

Binary data 720291.prm...

Hostinger Data Breach: 14M Customer Passwords, Personal Data at Risk

Web hosting company Hostinger is warning that a breach of one of its servers potentially gave bad actors access to the hashed passwords and personal data of more than 14 million customers. Hostinger, a popular web, cloud and virtual private server hosting provider and domain registrar with 29...

Forced Password Reset? Check Your Assumptions

Almost weekly now I hear from an indignant reader who suspects a data breach at a Web site they frequent that has just asked the reader to reset their password. Further investigation almost invariably reveals that the password reset demand was not the result of a breach but rather the site's...

CVE-2019-5040

An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send ...

CVE-2019-5040

An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send ...

Integer overflow

An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send ...

CVE-2019-5040

An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send ...

One simple action you can take to prevent 99.9 percent of attacks on your accounts

There are over 300 million fraudulent sign-in attempts to our cloud services every day. Cyberattacks aren’t slowing down, and it’s worth noting that many attacks have been successful without the use of advanced technology. All it takes is one compromised credential or one legacy application to...

polkit security and bug fix update

0.112-22.0.1 - Increase timeout to avoid defunct processes Orabug: 26930744 0.112-22 - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled - Resolves: rhbz1325512 0.112-21 - Mitigation of regression caused by fix of CVE-2018-19788 - Resolves: rhbz1656377 0.112-20 - Fix of...

HPE 3PAR Service Processor Authorization Issue Vulnerability

HPE 3PAR Service Processor SP is a suite of virtual service processors deployed on the VMware vSphere hypervisor from HPE, USA. An authorization issue vulnerability exists in HPE 3PAR Service Processor versions prior to 5.0.5.1. An attacker could exploit the vulnerability to reuse sessions...

HPE 3PAR StoreServ Management Console Session Reuse Vulnerability

The HPE 3PAR StoreServ Management Console SSMC is an HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. A remote session reuse vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. Detailed vulnerabilit...

NewStart CGSL MAIN 4.05 : curl Vulnerability (NS-SA-2019-0104)

The remote NewStart CGSL host, running version MAIN 4.05, has curl packages installed that are affected by a vulnerability: - It was found that the fix for CVE-2015-3148 in curl was incomplete. An application using libcurl with HTTP Negotiate authentication could incorrectly re-use credentials fo...

CVE-2019-5406

A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media versions: prior to 3.5.0.1...

CVE-2019-5400

A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor versions: prior to 5.0.5.1...

CVE-2019-5406

A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media versions: prior to 3.5.0.1...

CVE-2019-5406

A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media versions: prior to 3.5.0.1...

CVE-2019-5406

CVE-2019-5406 concerns a remote session reuse vulnerability in HPE 3PAR StoreServ Management Console and related software (Management and Core Software Media) prior to version 3.5.0.1. Connected documents consistently describe it as a remote session reuse issue affecting HPE 3PAR StoreServ manage...