The vulnerability of the set_host_domain_name function in Cisco Linksys E1200 and Cisco Linksys E2500 router microprogramming systems allows a hacker to gain full control over the vulnerable device.

The vulnerability of the sethostdomainname function libshared.so in Cisco Linksys E1200 and Cisco Linksys E250 router microprogramming systems exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability can allow ...

SUSE-SU-2019:0803-1 Security update for openssl

This update for openssl fixes the following issues: Security issues fixed: - The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations bsc1117951 - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond...

The vulnerability of the SetStaticRouteIPv6Settings() function in D-Link’s router software allows a hacker to execute arbitrary code.

The vulnerability of the SetStaticRouteIPv6Settings function in D-Link’s microprogrammed router software is related to insufficient cleaning of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the SetIPv4FirewallSettings() function in the D-Link router’s software allows a hacker to execute arbitrary code.

The vulnerability of the SetIPv4FirewallSettings function in the D-Link router’s software interface is related to insufficient cleaning of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

snap - seccomp BBlacklist for TIOCSTI can be Circumvented

/ snap uses a seccomp filter to prevent the use of the TIOCSTI ioctl; in the source code, this filter is expressed as follows: TIOCSTI allows for faking input man ttyioctl TODO: this should be scaled back even more ioctl - !TIOCSTI In the X86-64 version of the compiled seccomp filter, this result...

CVE-2019-7440

JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings aka a SetWiFiSetting request to cgi-bin/qcmapwebcgi...

Linux: SGID files

When the SGID set group ID bit is set on an executable, it executes with the GID of the owner. This may be intended for some executables. Add files with SGID bit which should be allowed to have this bit set in the preference. This script checks if any other local files than the given have the SGI...

Linux: SUID files

When the SUID set user ID bit is set on an executable, it executes with the UID of the owner. This may be intended for some executables. Add files with SUID bit which should be allowed to have this bit set in the preference. This script checks if any other local files than the given have the SUID...

Unpatched Fujitsu Wireless Keyboard Bug Allows Keystroke Injection

UPDATE Fujitsu is stopping sales for its popular wireless keyboard after a researcher discovered it is vulnerable to keystroke injection attacks that could allow an adversary to take control of a victim’s system. Researchers with Germany-based SySS reported on Friday that the high-severity...

CVE-2019-5019

A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro R1 7,0,2018,1113. While parsing Document Summary Property Set stream, the getSummaryInformation function is incorrectly checking the correlation betwe...

Key considerations for building vs. buying identity access management solutions

Time and time again, organizations learn the hard way that no matter which security solutions they have in place, if they haven’t properly secured the end user, their efforts can be easily rendered moot. The classic slip-up most often associated with end-user-turned-insider-threat is falling for ...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-05299)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS version 4.1.0 cross-site scripting vulnerability, remote attackers can use the /index.php?m=message&f=message&v=add URL's 'setiframe' parameter to use the vulnerability to inject...

Command injection

In Signiant Manager+Agents before 13.5, the implementation of the set command has a Buffer Overflow...

CVE-2019-8996

In Signiant Manager+Agents before 13.5, the implementation of the set command has a Buffer Overflow...

PT-2019-19299 · Signiant · Signiant Manager+Agents

Name of the Vulnerable Software and Affected Versions: Signiant Manager+Agents versions prior to 13.5 Description: The issue is related to a Buffer Overflow in the implementation of the set command. Recommendations: For versions prior to 13.5, update to version 13.5 or later to resolve the issue...

CVE-2019-8317

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

CVE-2019-8318

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

openSUSE Security Update : java-11-openjdk (openSUSE-2019-161)

This update for java-11-openjdk to version 11.0.2+7 fixes the following issues : Security issues fixed : - CVE-2019-2422: Better FileChannel transfer performance bsc1122293 - CVE-2019-2426: Improve web server connections - CVE-2018-11212: Improve JPEG processing bsc1122299 - Better route routing ...

Security update for java-11-openjdk (important)

openSUSE Security Update: Security update for java-11-openjdk Announcement ID: openSUSE-SU-2019:0161-1 Rating: important References: 1120431 1122293 1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 CVE-2019-2426 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilitie...

The vulnerability of the _set_key function in the software for deploying and using the SNMP protocol Net-SNMP allows a attacker to cause a service failure.

The vulnerability of the setkey function in the “agent/helpers/tablecontainer.c” file of the SNMP Net-SNMP deployment and usage software is related to a pointer arithmetic error. Exploiting this vulnerability could allow an attacker to cause system failures and service interruptions through a...