CVE-2018-18253: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local Administrators group for a very short time to execute a single command. However, the user is left in that group if the command crashes, an...

Red X appears under Synchronization State for WEM Agents

After recent upgrade of WEM Service, agents have started showing a red X under Synchronization state...

CVE-2019-9710: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests...

[SECURITY] Fedora 29 Update: systemd-239-12.git8bca462.fc29

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

[SECURITY] Fedora 28 Update: systemd-238-11.gita76ee90.fc28

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

Researchers Implant "Protected" Malware On Intel SGX Enclaves

Cybersecurity researchers have discovered a way to hide malicious code in Intel SGX enclaves, a hardware-based memory encryption feature in modern processors that isolates sensitive code and data to protect it from disclosure or modification. In other words, the technique allows attackers to...

Security update for java-11-openjdk (important)

openSUSE Security Update: Security update for java-11-openjdk Announcement ID: openSUSE-SU-2019:0161-1 Rating: important References: 1120431 1122293 1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 CVE-2019-2426 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilitie...

The vulnerability of the reposync function of the YUM package manager, which allows a hacker to create, modify, or delete any files they desire.

The vulnerability of the reposync function in the YUM package manager exists due to insufficient restrictions on the path name of the restricted access directory. Exploiting this vulnerability allows a malicious actor to create, modify, or delete any files as desired from a remote location...

Use-After-Free

Linux kernel is vulnerable to privilege escalation. A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKETV3 ring buffer. A local user able to op...

Validation Bypass

ntp is vulnerable to validation bypass. It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or...

Denial Of Service (DoS)

ntp is vulnerable to denial of service. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and...

The vulnerability of the implementation of TLS and SSL software such as Mbed TLS lies in the local synchronization during RSA decryption, which allows attackers to gain access to protected information.

The vulnerability of the implementation of TLS and SSL software developed by Mbed TLS relates to local synchronization during RSA decryption. Exploiting this vulnerability can allow attackers to gain access to protected information...

[SECURITY] Fedora 29 Update: systemd-239-8.gite339eae.fc29

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

CVE-2019-6133: Concurrent Execution using Shared Resource with Improper Synchronization

In PolicyKit aka polkit 0.115, the "start time" protection mechanism can be bypassed because fork is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c...

Design/Logic Flaw

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

CVE-2017-9704

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

CVE-2017-9704

CVE-2017-9704 concerns CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) where there is no synchronization between msm_vb2 buffer operations, enabling a use-after-free condition. Root cause: missing synchronization in buffer handling within the kernel component msm_vb2. Affec...

CVE-2017-9704

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

CVE-2018-17244: Concurrent Execution using Shared Resource with Improper Synchronization

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

PT-2018-3560

Name of the Vulnerable Software and Affected Versions: WildFly versions up to 16.0.0.Final Description: A flaw in WildFly allows local users who can execute init.d scripts to terminate arbitrary processes on the system. This can be exploited by modifying the PID file in /var/run/jboss-eap/,...