CVE-2019-17382

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password i.e., anonymously. All created elements...

CVE-2019-11924

A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00...

CVE-2019-15216

An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c driver...

Security Bulletin: IBM Jazz for Service Management is missing function level access control that could allow a user to delete authorized resources (CVE-2019-4194)

Summary IBM Jazz for Service Management is missing function level access control that could allow a user to delete authorized resources Vulnerability Details CVEID: CVE-2019-4194 DESCRIPTION: IBM Jazz for Service Management is missing function level access control that could allow a user to delet...

SUSE-SU-2019:1221-2 Security update for libxslt

This update for libxslt fixes the following issues: Security issue fixed: - CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead and xsltCheckWrite would permit access upon receiving an error bsc1132160...

Limitation of 256 characters only for TUNNEL_EXCLUDE_DOMAINS client property

When we try to add TUNNELEXCLUDEDOMAINS client property, it limits only for 256 characters. Due to which we cannot add extra domains apart from default ones. Default list:...

CVE-2019-10719

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714. Recent assessments: Leafr...

CVE-2018-18839

An issue was discovered in Netdata 1.10.0. Full Path Disclosure FPD exists via api/v1/alarms. NOTE: the vendor says "is intentional...

OPENSUSE-SU-2019:1507-1 Recommended update for GraphicsMagick

This update for GraphicsMagick fixes the following issues: Changes in GraphicsMagick: - disable also PCL decoding by default, as it is also passed through ghostscript boo1136183 This update was imported from the openSUSE:Leap:15.0:Update update project...

CVE-2019-12380

DISPUTED An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. physefisetvirtualaddressmap in arch/x86/platform/efi/efi.c and eficallphysprolog in arch/x86/platform/efi/efi64.c mishandle memory allocation failures. NOTE: This id is disputed as not being an issue because...

Integer Overflow

Git is vulnerable to integer overflow. A remote attacker could create a specially crafted Git repository that would cause a Git client or server to crash or, possibly, execute arbitrary code...

CVE-2019-9792

The IonMonkey just-in-time JIT compiler can leak an internal JSOPTIMIZEDOUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption, which results in a potentially exploitable crash. This vulnerability affects Thunderbird...

CVE-2018-18513

A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service DOS attack because Thunderbird reopens the last seen message on restart, triggering the crash again. This vulnerability affects Thunderbird 60.5...

SUSE-SU-2019:1047-1 Security update for pacemaker

This update for pacemaker fixes the following issues: Security issues fixed: - CVE-2019-3885: Fixed an information disclosure in log output. bsc1131357 - CVE-2018-16877: Fixed a local privilege escalation through insufficient IPC client-server authentication. bsc1131356 - CVE-2018-16878: Fixed a...

OPENSUSE-SU-2019:1228-1 Security update for pspp

This update for pspp fixes the following issues: - CVE-2019-9211: Handle a reachable assertion in writelongstringmissingvalues in libdata.a that could have lead to denial of service. boo1127343. - Remove excessive -n argument to %build, and excessive %defattr lines. This update was imported from...

CVE-2018-4361

A memory consumption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...

Font Awesome Icons - Critical - Remote Code Execution - SA-CONTRIB-2019-025

This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...

CVE-2019-1000011

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability...

CVE-2019-6462

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function arcerrornormalized in the file cairo-arc.c, related to arcmaxanglefortolerancenormalized...

PT-2019-18104

Name of the Vulnerable Software and Affected Versions cairo version 1.16.0 Description An issue was discovered in the function cairo arc in direction in the file cairo-arc.c, which is related to an assertion problem. Recommendations For cairo version 1.16.0, consider restricting access to the cai...