CVE-2019-9039

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "alldocs" endpoint. By issuing nested queri...

CVE-2019-9039

The CVE-2019-9039 issue affects Couchbase Sync Gateway 2.1.2, where an attacker with access to the public REST API could inject additional N1QL statements via the startkey/endkey parameters on the _all_docs endpoint. The underlying vulnerability is a N1QL injection that could disclose sensitive d...

PT-2019-5178 · Imagemagick +4 · Imagemagick +4

Name of the Vulnerable Software and Affected Versions: ImageMagick version 7.0.8-34 Description: The issue is related to the use of an uninitialized value in the SyncImageSettings function in MagickCore/image.c, which is also connected to AcquireImage in magick/image.c. This could potentially all...

Azure File Sync Agent v7.0 Release – June 2019 (KB4490495)

Update for Azure File Sync agent version 7.0.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v7.0 Release – June 2019 (KB4490495)

Update for Azure File Sync agent version 7.0.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v7.0 Release – June 2019 (KB4490495)

Update for Azure File Sync agent version 7.0.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v6.2 Release – June 2019 (KB4489738)

Update for Azure File Sync agent version 6.2.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v6.2 Release – June 2019 (KB4489738)

Update for Azure File Sync agent version 6.2.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v6.2 Release – June 2019 (KB4489738)

Update for Azure File Sync agent version 6.2.0.0. For more details, see the associated Microsoft Knowledge Base article...

PT-2019-6598 · Ubiquiti · Airmax Isp +2

Name of the Vulnerable Software and Affected Versions: Ubiquiti AirOS versions prior to 4.0.1 Ubiquiti AirMax ISP products versions prior to 5.3.5 Ubiquiti AirSync firmware versions prior to 5.4.5 Description: On certain Ubiquiti devices, Command Injection exists via a GET request to "stainfo.cgi...

CVE-2019-9838

VFront 0.99.5 has stored XSS via the admin/syncregtab.php azzera parameter, which is mishandled during admin/errorlog.php rendering...

Changing public flag in Repository Permissions does not reflect on mirrors

h3. Issue Summary When Public flag is enabled/disabled for a mirrored repository, it doesn't sync on corresponding mirrors. h3. Steps to Reproduce Setup BbS Mirror and approve it on upstream. Create a repository in some project, let's say Project A, and set Public flag as Enabled in Repository...

Changing public flag in Repository Permissions does not reflect on mirrors

h3. Issue Summary When Public flag is enabled/disabled for a mirrored repository, it doesn't sync on corresponding mirrors. h3. Steps to Reproduce Setup BbS Mirror and approve it on upstream. Create a repository in some project, let's say Project A, and set Public flag as Enabled in Repository...

Demystifying Password Hash Sync

This blog is part of a series of posts providing a behind-the-scenes look of Microsoft’s Detection and Response Team DART. While responding to cybersecurity incidents around the world, DART engages with customers who are wary about using Password Hash Sync PHS or are not utilizing this service’s...

Siemens SIPLUS SYNC-MODULE Detection

Binary data 750298.prm...

Siemens SIPLUS SYNC-MODULE Detection

Binary data 750299.prm...

Denial Of Service (DoS)

NTP is vulnerable to denial of service attacks. A remote, unauthenticated attacker could set the jitter value to be higher than expected causing an error in the calculation of root sync delay leading to denial of service conditions. Affected component is Initial Sync Calculation...

Use-After-Free

mozilla frefox is vulnerable to use-after-free vulnerability. Remote attackers can execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop...

SUSE-SU-2018:3467-2 Security update for smt

SMT was updated to version 3.0.38. Following security issue was fixed: - CVE-2018-12472: Harden hostname check during sibling check by forcing double reverse lookup bsc1104076 Following non security issues were fixed: - Add migration path check when registration sharing is enabled - Fix sibling...

Cross-site Scripting (XSS)

vuex-router-sync is vulnerable to cross-site scripting XSS attacks. The route parameter used in the server-rendered store in Nuxt render:routeContext hook are not sanitized, allowing an attacker to insert arbitrary Javascript...