Google Uncovers How Just Visiting Some Sites Were Secretly Hacking iPhones For Years

Beware Apple users! Your iPhone can be hacked just by visiting an innocent-looking website, confirms a terrifying report Google researchers released earlier today. The story goes back to a widespread iPhone hacking campaign that cybersecurity researchers from Google's Project Zero discovered...

PT-2019-4911 · Apple +5 · Icloud +12

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.4 macOS Mojave versions prior to 10.14.6 tvOS versions prior to 12.4 watchOS versions prior to 5.3 Safari versions prior to 12.1.2 iTunes for Windows versions prior to 12.9.6 iCloud for Windows versions prior to 7.13...

Cisco Enterprise Network Functions Virtualization Infrastructure Software Input Validation Error Vulnerability

Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS is a set of Linux-based infrastructure software from Cisco. The software is mainly used for designing, deploying and managing network services and dynamically deploying virtualized network functions on supported Cisco...

Update for Windows 8.1 and Windows Server 2012 R2: August 16, 2019

Update for Windows 8.1 and Windows Server 2012 R2: August 16, 2019 Summary This non-security update for Windows 8.1 and Windows Server 2012 R2 includes the quality improvements from KB4512489 released August 16, 2019, in addition to these key changes: Addresses an issue in which the following may...

PT-2019-16995 · Ibm · Ibm Informix Dynamic Server Enterprise Edition

Name of the Vulnerable Software and Affected Versions: IBM Informix Dynamic Server Enterprise Edition version 12.1 Description: The issue allows a local privileged Informix user to load a malicious shared library, potentially gaining root access privileges. Recommendations: For IBM Informix Dynam...

PT-2019-9299 · Ibm · Ibm Informix Dynamic Server Enterprise Edition

Name of the Vulnerable Software and Affected Versions: IBM Informix Dynamic Server Enterprise Edition version 12.1 Description: A stack-based buffer overflow issue exists, allowing an authenticated user to execute predefined code with root privileges. This could potentially enable an attacker to...

PT-2019-9295 · Ibm · Ibm Informix Dynamic Server Enterprise Edition

Name of the Vulnerable Software and Affected Versions: IBM Informix Dynamic Server Enterprise Edition version 12.1 Description: The issue allows a local user logged in with database administrator privileges to gain root privileges through a symbolic link vulnerability in oninit mongohash...

USN-4078-2 openldap vulnerabilities

USN-4078-1 fixed several vulnerabilities in openldap. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that OpenLDAP incorrectly handled rootDN delegation. A database administrator could use this issue to request...

OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Utilities. Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

Frappe Technologies Frappe Framework Injection Vulnerability

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. An injection vulnerability exists in Frappe Technologies Frappe Framework versions 10 through 12 fixed in version 12.0.4. No detailed...

Frappe Technologies Frappe Framework SQL Injection Vulnerability

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A SQL injection vulnerability exists in Frappe Technologies Frappe Framework versions 10 through 12, which can be exploited by an attacker...

Frappe Technologies Frappe Framework Cross-Site Scripting Vulnerability

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A cross-site scripting vulnerability exists in Frappe Technologies Frappe Framework version 10, version 11 before 11.1.46, and version 12,...

EC-CUBE plugin "Amazon Pay Plugin 2.12,2.13" vulnerable to cross-site scripting

Overview EC-CUBE plugin "Amazon Pay Plugin 2.12,2.13" provided by IPLOGIC CO.,LTD. contains a cross-site scripting vulnerability CWE-79. Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element

An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element...

PT-2019-17779 · Freebsd · Freebsd +2

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.0-STABLE before r350637 FreeBSD versions 12.0-RELEASE before 12.0-RELEASE-p9 FreeBSD versions 11.3-STABLE before r350638 FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p2 FreeBSD versions 11.2-RELEASE before...

PT-2019-13697 · FFmpeg · Libav

Name of the Vulnerable Software and Affected Versions: Libav version 12.3 Description: An issue in Libav allows remote attackers to cause a denial of service, resulting in an application crash. This is due to a division by zero in the range decode culshift function in libavcodec/apedec.c, as...

UBUNTU-CVE-2019-14371

An issue was discovered in Libav 12.3. There is an infinite loop in the function movprobe in the file libavformat/mov.c, related to offset and tag...

PT-2019-13649 · FFmpeg · Libav

Name of the Vulnerable Software and Affected Versions: Libav version 12.3 Description: The issue is related to an infinite loop in the function wv read block header located in the file wvdec.c. Recommendations: For Libav version 12.3, consider disabling the wv read block header function as a...

redis: Heap corruption in lua_cmsgpack.c

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows...

Apple iOS, Apple tvOS and watchOS Core Data Component Resource Management Error Vulnerability

Apple iOS is an operating system developed for mobile devices. apple tvOS is a smart TV operating system. apple watchOS is a smart watch operating system. core data is one of the frameworks used to manage the model layer objects in an application. A resource management error vulnerability exists ...