OPENSUSE-SU-2019:1758-1 Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues: Security issues fixed: - CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream bsc1122983. - CVE-2018-18501: Fixed multiple memory safety bugs bsc1122983. - CVE-2018-18505: Fixed a privilege escalation through IPC chann...

OPENSUSE-SU-2019:1753-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...

Remote Code Execution in GlobalProtect Portal/Gateway Interface

Palo Alto Networks is aware of the reported remote code execution RCE vulnerability in its GlobalProtect portal and GlobalProtect Gateway interface products. The issue is already addressed in prior maintenance releases. Ref: CVE-2019-1579 Successful exploitation of this issue allows an...

Zoom RCE Flaw Also Affects Its Rebranded Versions RingCentral and Zhumu

The same security vulnerabilities that were recently reported in Zoom for macOS also affect two other popular video conferencing software that under the hood, are just a rebranded version of Zoom video conferencing software. Security researchers confirmed The Hacker News that RingCentral, used by...

JVN#62618482: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. DOM-based cross-site scripting in the application "Portal" CWE-79 - CVE-2019-5975 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 4.4 CVSS v2|...

PT-2019-6418

Name of the Vulnerable Software and Affected Versions resteasy versions 3.x.x prior to 3.12.0.Final resteasy versions 4.x.x prior to 4.6.0.Final Description A flaw was found in resteasy where an improper input validation results in returning an illegal header that integrates into the server's...

SUSE-SU-2019:1850-1 Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.24.2 fixes the following issues: Security issues fixed: - CVE-2019-6237, CVE-2019-8571, CVE-2019-8583, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595, CVE-2019-8596, CVE-2019-8597, CVE-2019-8601, CVE-2019-8607, CVE-2019-8608,...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The...

CVE-2019-12574: Untrusted Search Path

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The...

PT-2019-6020 · Proclima · Proclima

Name of the Vulnerable Software and Affected Versions: ProClima versions prior to 8.0.0 Description: The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code on the targeted system. This can potentially allow an unauthenticated,...

PT-2019-4362 · Cz.Nic +2 · Knot Resolver +2

Name of the Vulnerable Software and Affected Versions: knot resolver versions prior to 4.1.0 Description: A vulnerability was discovered in the DNS resolver of knot resolver, which allows remote attackers to downgrade DNSSEC-secure domains to a DNSSEC-insecure state. This opens the possibility of...

WordPress Attendance Manager plugin <= 0.5.6 - Cross-Site Request Forgery CSRF and Cross-Site Scripting (XSS) vulnerabilities

Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS vulnerabilities found in WordPress Attendance Manager plugin versions = 0.5.6. Solution Update the WordPress Attendance Manager plugin to the latest available version at least 0.5.7...

SAP ERP HCM CVE-2019-0325 Remote Authorization Bypass Vulnerability

Description SAP ERP HCM Basis is prone to an authorization-bypass vulnerability. Attackers can exploit this issue to gain unauthorized access and obtain sensitive information. This may aid in further attacks. Technologies Affected SAP ERP HCM 3.0 Recommendations Block external access at the netwo...

ICSA-19-190-04 Siemens Spectrum Power (Update A)

1. EXECUTIVE SUMMARY CVSS v3 4.7 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Spectrum Power Vulnerability: Cross-site Scripting 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-19-190-04 Siemens Spectrum...

Information Disclosure in WildFire Appliance (WF-500)

Palo Alto Networks has determined that the WildFire Appliance WF-500 is affected by the vulnerability disclosure known as LazyFP and has completed an update to address these issues. The WildFire Appliance WF-500 software update is now available to customers that use the WildFire Appliance WF-500...

DLA-1847-1 squid3 - security update

Bulletin has no description...

PT-2019-17914 · Google · Youtube

Name of the Vulnerable Software and Affected Versions: Related YouTube Videos versions prior to 1.9.9 Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators via unspecified vectors. Recommendations: For versions prior to 1.9.9,...

Cisco Web Security Appliance Web Proxy Denial of Service Vulnerability

A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation mechanisms for...

Cisco Small Business Series Switches HTTP Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper validation of requests sent to the web...

Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS of an affected device as root. The vulnerability is due to insufficient input validation of a configuration file...