PT-2019-18002 · Lenovo · Thinkpad

Name of the Vulnerable Software and Affected Versions: ThinkPad systems affected versions not specified Description: A reported issue in certain ThinkPad systems' BIOS could allow a user with administrative privileges or physical access to update the Embedded Controller with unsigned firmware...

OPENSUSE-SU-2019:1911-1 Security update for icedtea-web

This update for icedtea-web to version 1.7.2 fixes the following issues: Security issues fixed: - CVE-2019-10181: Fixed an unsigned code injection in a signed JAR file bsc1142835 - CVE-2019-10182: Fixed a path traversal while processing elements of JNLP files results in arbitrary file overwrite...

Microsoft Live Accounts Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Outlook Web Access OWA regarding a possible unsigned token. An attacker who successfully exploited this vulnerability could have access to another person's email inbox. To exploit this vulnerability, an attacker would first have to replace an...

RHEL 8 : icedtea-web (RHSA-2019:2004)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2004 advisory. The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It...

Oracle Linux 7 : icedtea-web (ELSA-2019-2003)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2003 advisory. - added patch1, patch4 and patch11 to fix CVE-2019-10182 - added patch2 to fix CVE-2019-10181 - added patch3 and patch33 to fix CVE-2019-10185 Tenable...

RHEL 7 : icedtea-web (RHSA-2019:2003)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2003 advisory. The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It...

Oracle Linux 8 : icedtea-web (ELSA-2019-2004)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2004 advisory. - added patch1, patch4 and patch11 to fix CVE-2019-10182 - added patch2 to fix CVE-2019-10181 - added patch3 and patch33 to fix CVE-2019-10185 Tenable...

Applocker Evasion - Microsoft Workflow Compiler

This module will assist you in evading Microsoft Windows Applocker and Software Restriction Policies. This technique utilises the Microsoft signed binaries Microsoft.Workflow.Compiler.exe to execute user supplied code. This module requires Metasploit: https://metasploit.com/download Current sourc...

Multiple Lenovo Products Privilege License and Access Control Issues Vulnerabilities

The Lenovo ThinkPad 10 20E3 and others are products of Lenovo, a Chinese company.The Lenovo ThinkPad 10 20E3 is a tablet PC.The ThinkPad 10 20E4 is a tablet PC.The ThinkPad 13 KBL 20J1 is a laptop PC. A privilege permission and access control issue vulnerability exists in systems in multiple Leno...

kernel: Buffer overflow in hidp_process_report

A buffer overflow due to a singed-unsigned comparsion was found in hidpprocessreport in the net/bluetooth/hidp/core.c in the Linux kernel. The buffer length is an unsigned int but gets cast to a signed int which in certain conditions can lead to a system panic and a denial-of-service...

Embedded Controller Update Vulnerability - Lenovo Support US

No description provided...

CVE-2019-3717

Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system...

Improper access control

Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system...

CVE-2019-3717

CVE-2019-3717 affects Dell Client Commercial and Consumer platforms. The vulnerability is an improper access control that could allow an unauthenticated attacker with physical access to bypass Secure Boot and run unsigned/untrusted code on expansion cards during platform boot. Impact concerns: co...

Remote Code Execution

icedtea-web is vulnerable to remote code execution. It is due to unsigned code injection in a signed JAR file...

PT-2019-16662 · Dell · Dell Client Commercial +1

Name of the Vulnerable Software and Affected Versions: Dell Client Commercial and Consumer platforms affected versions not specified Description: The issue allows an unauthenticated attacker with physical access to bypass Secure Boot restrictions, enabling them to run unsigned and untrusted code ...

icedtea-web: unsigned code injection in a signed JAR file

It was found that executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox...

icedtea-web: unsigned code injection in a signed JAR file

It was found that executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox...

procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues

A flaw was found where procps-ng provides wrappers for standard C allocators that took unsigned int instead of sizet parameters. On platforms where these differ such as x8664, this could cause integer truncation, leading to undersized regions being returned to callers that could then be overflowe...

CVE-2019-1010204

GNU binutils gold gold v1.11-v1.16 GNU binutils v2.21-v2.31.1 is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcppfile.h:644. The attack vector is: An ELF file with an...