BIOS Write Protection Race Condition - US

Lenovo Security Advisory: LEN-20184 Potential Impact: Privilege escalation Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2018-9069 Summary Description: In several consumer notebook models, a race condition in BIOS flash device locking mechanism is not adequately protected...

TP-Link TL-WR886N Denial of Service Vulnerability (CNVD-2019-07048)

The TP-Link TL-WR886N is a wireless router product from China P&L TP-LINK. A security vulnerability exists in TP-Link TL-WR886N version 6.0 2.3.4 and 7.0 1.1.0. An attacker can exploit the vulnerability by sending a request with long JSON data to cause the router service to crash...

Mail.ru: XSS in touch.mail.ru

Browser specific user assisted DOM based XSS in message editor undo functionality via quoted content. Vulnerability did not affected mobile browsers used by majority of touch.mail.ru web interface users...

domainname.gov.au Improper Access Control vulnerability

Open Bug Bounty ID: OBB-676003 Description| Value ---|--- Affected Website:| domainname.gov.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

Schneider Electric M580PLC Has Denial of Service Vulnerability

The Schneider Electric M580 PLC is a Schneider Electric synergistic automation system. A denial of service vulnerability exists in the Schneider Electric M580PLC. An attacker can cause the PLC to deny service by sending specific packets...

Google Expands Bug-Bounty Program to Battle Abuse Methods

Google is now offering rewards for newly-discovered techniques that bad actors could use to bypass its systems protecting against abuse, fraud and spam. The company has expanded its bug bounty program scope beyond security vulnerabilities to also focus on mitigations around potential abuse method...

VMSA-2018-0020:VMware vSphere, Workstation, and Fusion updates enable Hypervisor-Specific Mitigations for L1 Terminal Fault - VMM vulnerability.

VMSA-2018-0020 VMware vSphere, Workstation, and Fusion updates enable Hypervisor-Specific Mitigations for L1 Terminal Fault - VMM vulnerability. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0020 VMware Security Advisory Severity: Important VMware Security Advisory...

CVE-2018-12466

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links...

DEBIAN-CVE-2018-12466

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links...

CVE-2018-12466

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links...

CVE-2018-12466

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links...

CVE-2018-7947

Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153C00 have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific...

Immunity Canvas: SHOW_TIMER_LEAK

Name| showtimerleak ---|--- CVE| CVE-2017-18344 Exploit Pack| CANVAS Description| showtimerleak Notes| CVE Name: CVE-2017-18344 NOTES: This module gives an unpriviledged user the ability to dump a file from the kernel memory. A common scenario is to dump the /etc/shadow or kerberos tickets. Note:...

XClarity Administrator (LXCA) API Vulnerabilities - Lenovo Support US

No description provided...

CVE-2017-7543

A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0:...

Intel ME 6.x/7.x/8.x/9.x/10.x./11.x, SPS 4.0, and TXE 3.0 Cumulative Security Update - US

Lenovo Security Advisory: LEN-17297 Potential Impact: An attacker could load and execute arbitrary code outside the visibility of the user, operating system, and hypervisor/virtualization platform; resulting in exfiltration of secrets, subtle manipulation of system operation, or denial of service...

Unsafe deserialization in confire

An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An...

CVE-2018-10886

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: this candidate is not about any specific product, protocol, or design, that falls into the scope of the assigning CNA. Notes: None...

Sql injection

The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection. One consequence is that an application without the READSMS permission can read SMS messages. This affects Infinix X571 phones, as well as various Lenovo...

Junos OS: MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) and PTX1K: Line card may crash upon receipt of specific MPLS packet.

Receipt of a specific MPLS packet may cause MPC7/8/9, PTX-FPC3 FPC-P1, FPC-P2 line cards or PTX1K to crash and restart. By continuously sending specific MPLS packets, an attacker can repeatedly crash the line cards or PTX1K causing a sustained Denial of Service. Affected releases are Juniper...