NewStart CGSL CORE 5.05 / MAIN 5.05 : mercurial Multiple Vulnerabilities (NS-SA-2019-0234)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mercurial packages installed that are affected by multiple vulnerabilities: - Mercurial version 4.5 and earlier contains a Incorrect Access Control CWE-285 vulnerability in Protocol server that can result in Unauthorized da...

PT-2019-17948

Name of the Vulnerable Software and Affected Versions Cybozu Office versions 10.0.0 through 10.8.3 Description The issue allows remote authenticated attackers to bypass access restrictions, potentially resulting in obtaining data without proper access privileges. This is achieved via the...

CVE-2019-17335: Undefined Security Weakness

The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacke...

JVN#79854355: Multiple vulnerabilities in Cybozu Office

Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Directory traversal in the "Customapp" function CWE-22 - CVE-2019-6022 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N| Base Score: 7.7 CVSS v2|...

PT-2019-15095

Name of the Vulnerable Software and Affected Versions TIBCO Spotfire Analytics Platform for AWS Marketplace version 10.6.0 TIBCO Spotfire Server versions 7.11.7 and below TIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3,...

Microsoft Access Database Unauthorized Access

The vulnerability of the relational database management system used in Microsoft Access programs from Microsoft Office and Office 365 is related to errors in object processing in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information throu...

Microsoft Access Database Unauthorized Access

The vulnerability of the relational database management system used in Microsoft Access programs from Microsoft Office and Office 365 is related to errors in object processing in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information throu...

Intel Baseboard Management Controller Information Disclosure Vulnerability

The Intel Baseboard Management Controller BMC is a baseboard management controller from Intel Corporation USA. An information disclosure vulnerability exists in Intel BMC, which arises from errors in the configuration of a networked system or product during operation, and can be exploited by an...

JDK: unspecified vulnerability fixed in 8u221 (Deployment)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Deployment. The supported version that is affected is Java SE: 8u221; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

PT-2019-5228

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.0.M1 through 9.0.29 Apache Tomcat versions 8.5.0 through 8.5.49 Apache Tomcat versions 7.0.0 through 7.0.98 Description The issue is related to a session fixation attack when using FORM authentication. An attacker...

CVE-2019-11255

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...

NewStart CGSL CORE 5.04 / MAIN 5.04 : mercurial Multiple Vulnerabilities (NS-SA-2019-0216)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has mercurial packages installed that are affected by multiple vulnerabilities: - Mercurial version 4.5 and earlier contains a Incorrect Access Control CWE-285 vulnerability in Protocol server that can result in Unauthorized da...

DirectWrite Unprotected Access

The vulnerability of the DirectWrite programming interface in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created web page or document...

syndesis: default CORS configuration is allow all

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...

CVE-2019-0391

Under certain conditions SAP NetWeaver AS Java corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 allows an attacker to access information which would otherwise be restricted...

CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

Am I vulnerable? CSI snapshot, cloning and resizing features are affected. Prior to Kubernetes 1.16, these features were all alpha and disabled by default. Starting in Kubernetes 1.16, CSI cloning and resizing features are beta and enabled by default. These features also require CSI drivers to be...

mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructu...

mysql: InnoDB unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageGateway

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Version 8.0 used by IBM MessageGateway These issues were disclosed as part of the IBM Java SDK updates in July 2019. Vulnerability Details CVEID: CVE-2019-11775 DESCRIPTION: All builds of Eclipse OpenJ9 prior to 0.15 conta...

Fluid Core Oracle PeopleSoft Enterprise PeopleTools Unauthorized Access

The vulnerability of the Fluid Core component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected data or compromise the integrity of...