openSUSE: Security Advisory for haproxy (openSUSE-SU-2019:2556-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Code injection

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the...

CVE-2019-9812

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the...

CVE-2019-11761: Concurrent Execution using Shared Resource with Improper Synchronization

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox 70,...

CVE-2019-9812: Undefined Security Weakness

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the...

CVE-2014-0245: Concurrent Execution using Shared Resource with Improper Synchronization

It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain...

CVE-2012-6111

gnome-keyring does not discard stored secrets when using gnomekeyringlockallsync function...

CVE-2019-8757: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition existed when reading and writing user preferences. This was addressed with improved state handling. This issue is fixed in macOS Catalina 10.15. The "Share Mac Analytics" setting may not be disabled when a user deselects the switch to share analytics...

CVE-2019-8606: Concurrent Execution using Shared Resource with Improper Synchronization

A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Mojave 10.14.5. A local user may be able to load unsigned kernel extensions...

USN-4182-3: Intel Microcode regression | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-4182-1 provided updated Intel Processor Microcode. A regression was discovered that caused some Skylake processors to hang after a warm reboot. This update reverts the microcode for that specific...

CVE-2014-3701: Concurrent Execution using Shared Resource with Improper Synchronization

eDeploy has tmp file race condition flaws...

The vulnerability of the Oilpan component in the Google Chrome browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Oilpan component in the Google Chrome browser is caused by synchronization errors when using a common resource. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a...

The compatibility subsystem for running Linux applications allows the Windows Subsystem for Linux (WSL), a operating system that enables attackers to enhance their privileges.

The vulnerability of the compatibility subsystem for running Linux applications stems from synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges through a specially created application...

The vulnerability of the mod_auth_digest component in the Apache HTTP Server allows a hacker to bypass authentication by using a different username.

The vulnerability of the modauthdigest component in the Apache HTTP Server arises due to synchronization errors when using a shared resource. Exploiting this vulnerability allows a malicious actor to perform authentication using a different username...

The vulnerability of the Apache Tomcat application server arises from synchronization errors when using a shared resource, allowing attackers to expose sensitive information.

The vulnerability of the Apache Tomcat application server arises due to synchronization errors when using a shared resource. Exploiting this vulnerability allows a malicious actor to disclose sensitive information remotely...

The vulnerability of Google Chrome arises from synchronization errors when using a common resource, allowing a perpetrator to replace the content of the Omnibox component (URL).

The vulnerability of Google Chrome arises due to synchronization errors when using a common resource. Exploiting this vulnerability allows an attacker to replace the content of the Omnibox component URL by using a specially created HTML page...

CVE-2019-19017: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this to gain root privileges on the system...

SQL Injection Vulnerability in ba***.php File of Kindergarten Online Management System

Xianqi Kindergarten Online Management System is a kindergarten online management system that supports real-time synchronization of data between smartphone APP and computer. A SQL injection vulnerability exists in the ba.php file of the kindergarten online management system. An attacker can exploi...

The vulnerability of Siemens’ software and hardware devices, related to the possibility of disrupting time synchronization (IRT), allows a perpetrator to trigger a service failure.

The vulnerability of Siemens’ software and hardware devices is related to the possibility of disrupting time synchronization IRT. Exploiting this vulnerability can allow a remote attacker to cause service failures...

[SECURITY] Fedora 31 Update: systemd-243.4-1.fc31

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...