openSUSE Security Update : MozillaThunderbird (openSUSE-2019-680)

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2019-1177)

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Libraries. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker...

CVE-2018-17490

EasyLobby Solo is vulnerable to a denial of service. By visiting the kiosk and accessing the task manager, a local attacker could exploit this vulnerability to kill the process or launch new processes at will...

CVE-2018-17494

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Start Menu. By visiting the kiosk and pressing windows key twice, an attacker could exploit this vulnerability to close the program and launch other processes on the...

Code injection

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Start Menu. By visiting the kiosk and pressing windows key twice, an attacker could exploit this vulnerability to close the program and launch other processes on the...

HID Global EasyLobby Solo Access Control Error Vulnerability (CNVD-2019-12473)

HID Global EasyLobby Solo is a suite of Secure Visitor Management SVM software from HID Global, USA. A security vulnerability exists in HID Global EasyLobby Solo version 11.0.4563. A local attacker can exploit the vulnerability by accessing the self-service server and task manager to terminate...

eVisitorPass Elevation of Privilege Vulnerability

Threshold eVisitorPass is a visitor management system from Threshold Canada. A privilege-lifting vulnerability exists in Threshold eVisitorPass version 1.5.5.2. A local attacker could use this vulnerability to open the task manager, terminate processes, or start other processes...

CVE-2018-17494

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Start Menu. By visiting the kiosk and pressing windows key twice, an attacker could exploit this vulnerability to close the program and launch other processes on the...

exacqVision 9.8 Unquoted Service Path Privilege Escalation

exacqVision 9.8 Unquoted Service Path Privilege Escalation Vendor: Exacq Technologies, Inc. Product web page: https://www.exacq.com Affected version: 9.8.4.150001 Summary: The exacqVision VMS Video Management System software records surveillance video from thousands of IP camera models and displa...

DEBIAN-CVE-2019-9656

An issue was discovered in LibOFX 0.9.14. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofxsgml.cpp, as demonstrated by ofxdump...

PT-2019-19780 · Libofx +3 · Libofx +3

Name of the Vulnerable Software and Affected Versions: LibOFX version 0.9.14 Description: An issue was discovered in LibOFX. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofx sgml.cpp, as demonstrated by ofxdump. Recommendations: For LibOFX versi...

start-selenium (>=0.0.1, <=0.0.5) potentially affected by CVE-2016-10565 via operadriver (0.2.2)

operadriver NPM version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on operadriver and may be impacted: - start-selenium =0.0.1, =0.0.5 Source cves: CVE-2016-10565 Source advisory: OSV:GHSA-2WRQ-WMQF-8VCC...

PT-2019-2904 · Sox +2 · Sox +2

Name of the Vulnerable Software and Affected Versions: SoX versions 14.4.2 Description: The issue is related to an integer overflow in the channels start function of the SoX audio editor, which can lead to a heap-based buffer overflow. This can be exploited by a remote attacker to cause a denial ...

Unitronics PCOM remote START/STOP/RESET command

Unitronics Vision PLCs allow remote administrative functions to control the PLC using authenticated PCOM commands. This module supports START, STOP and RESET operations. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

XenApp7.15-Start menu is blank in ICA session, no icons are visible

...

UBUNTU-CVE-2018-18505

An earlier fix for an Inter-process Communication IPC vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the...

Qualys Cloud Platform (VM, PC) 8.16 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.16, contains several new improvements in Qualys Vulnerability Management and Qualys Policy Compliance, which includes new password security option, increased limit for virtual hosts that can be added to a subscription, added support...

January 22, 2019—KB4476976 (OS Build 17763.292)

None None...

CVE-2019-2422

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CVE-2019-2426

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...