1448 matches found
UBUNTU-CVE-2019-15239
In the Linux kernel, a certain net/ipv4/tcpoutput.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting...
DEBIAN-CVE-2019-15118
checkinputterm in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion...
jenkins: CSRF protection tokens did not expire (SECURITY-626)
A flaw was found in Jenkins in weekly versions prior to 2.186 and LTS versions prior to 2.176.2. By default, CSRF tokens in Jenkins only checked user authentication and IP address which allowed attackers able to obtain a CSRF token for another user. This allowed an attacker to implement CSRF...
USN-4049-3 glib2.0 regression
USN-4049-1 fixed a vulnerability in GLib. The update introduced a regression in Ubuntu 16.04 LTS causing a possibly memory leak. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GLib created directories and files without properly...
CloudBees Jenkins Cross-Site Request Forgery Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...
July 16, 2019—KB4507459 (OS Build 14393.3115)
None None...
CVE-2019-13478
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions...
Design/Logic Flaw
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions...
CVE-2019-13478
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions...
PT-2019-13358 · Yoast · Yoast Seo Plugin
Name of the Vulnerable Software and Affected Versions: Yoast SEO plugin versions prior to 11.6-RC5 Description: The issue concerns the improper restriction of unfiltered HTML in term descriptions, which could lead to potential security risks. Recommendations: For versions prior to 11.6-RC5, updat...
June 27, 2019—KB4509475 (OS Build 14393.3056)
None None...
June 18, 2019—KB4503294 (OS Build 14393.3053)
None None...
June 11, 2019—KB4503327 (OS Build 17763.557)
None None...
CVE-2019-2102
In the Bluetooth Low Energy BLE specification, there is a provided example Long Term Key LTK. If a BLE device were to use this as a hardcoded LTK, it is theoretically possible for a proximate attacker to remotely inject keystrokes on a paired Android host due to improperly used crypto. User...
Hardcoded credentials
In the Bluetooth Low Energy BLE specification, there is a provided example Long Term Key LTK. If a BLE device were to use this as a hardcoded LTK, it is theoretically possible for a proximate attacker to remotely inject keystrokes on a paired Android host due to improperly used crypto. User...
CVE-2019-2102
In the Bluetooth Low Energy BLE specification, there is a provided example Long Term Key LTK. If a BLE device were to use this as a hardcoded LTK, it is theoretically possible for a proximate attacker to remotely inject keystrokes on a paired Android host due to improperly used crypto. User...
PT-2019-16194 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions 7.0 through 9 Description: The issue concerns the improper use of crypto in Bluetooth Low Energy BLE devices, specifically when a hardcoded Long Term Key LTK is used. This could theoretically allow a proximate attacker to...
May 23, 2019—KB4499177 (OS Build 14393.2999)
None None...
Towards an Information Operations Kill Chain
Cyberattacks don't magically happen; they involve a series of steps. And far from being helpless, defenders can disrupt the attack at any of those steps. This framing has led to something called the "cybersecurity kill chain": a way of thinking about cyber defense in terms of disrupting the...