Privilege Escalation

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when...

Denial Of Service (DoS)

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when...

Information Disclosure

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when...

Symlink Attack

ibutils is vulnerable to symlink attack. A flaw was found in the way ibutils handled temporary files. A local attacker could use this flaw to cause arbitrary files to be overwritten as the root user via a symbolic link attack...

Heap-based Out-Of-Bounds Write

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way IP packets with an Internet Header Length ihl of zero were processed in the skbflowdissect function in the Linux kernel. A remote attacker could use this flaw to trigger an infinit...

Symlink Attack

Red Hat Storage is a software only, scale-out storage solution that provides flexible and agile unstructured data storage for the enterprise. A flaw was found in the way the Swift component used Python pickle. This could lead to arbitrary code execution. With this update, the JSON JavaScript Obje...

Fedora 30 : libqb (2019-67e684044e)

Security fix for 'Insecure treatment of IPC temporary files' CVE pending Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

PT-2019-18332 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2019.010.20098 Description: This issue allows remote attackers to disclose sensitive information on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious...

UBUNTU-CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

kernel: userfaultfd bypasses tmpfs file permissions

A flaw was found in the Linux kernel with files on tmpfs and hugetlbfs. An attacker is able to bypass file permissions on filesystems mounted with tmpfs/hugetlbs to modify a file and possibly disrupt normal system behavior. At this time there is an understanding there is no crash or privilege...

Oracle WebLogic remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net

2019 04 on 17 May, the National information security vulnerabilities sharing platform CNVD official released a security Bulletin called Oracle WebLogic wls9-async components deserialization of a remote command execution vulnerability, an attacker can use this vulnerability, unauthorized remote...

PT-2019-12274 · Owasp +1 · Owasp Modsecurity Core Rule Set +1

Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions through 3.1.0 Description: An issue was discovered in OWASP ModSecurity Core Rule Set CRS that allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with...

EulerOS Virtualization 2.5.4 : rpm (EulerOS-SA-2019-1210)

According to the version of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that rpm uses temporary files with predictable names when installing an RPM. An attacker with ability to write in a...

CVE-2018-19981

Amazon AWS SDK =2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege...

CVE-2018-19981

Amazon AWS SDK =2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege...

EulerOS Virtualization 2.5.3 : sqlite (EulerOS-SA-2019-1275)

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - osunix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to...

CVE-2018-19981: Cleartext Storage of Sensitive Information

Amazon AWS SDK =2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege...

PortSwigger Web Security: DLL Hijacking in Burp Suite Pro 2.0.19 Installer

I've found that the latest installer of Burp Suite Pro tries to load some DLLs from an unprotected folder. After providing it with admin privileges required to install it tries to load these DLLs: C:\Users\bortto\AppData\Local\Temp\e4jA5E5.tmpdir1553882416\jre\bin\WINMM.dll...

Denial Of Service (DoS)

Apache Tomcat is vulnerable to denial of service vulnerability. A remote user can send a malicious request with a malformed HTTP Host header via the Java AJP connector to cause the target modjk load balancing worker to be blocked for approximately one minute, resulting in a temporary denial of...

CVE-2018-17955

CVE-2018-17955 affects yast2-multipath prior to version 4.1.1. The vulnerability arises from a static temporary filename that allows local attackers to overwrite files on systems without symlink protection. Impact is described as local complete/partial integrity on affected files with potential a...