PT-2019-10840 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.13.6 Description: Multiple memory corruption issues were addressed with improved memory handling. Recommendations: For versions prior to 10.13.6, update to macOS High Sierra 10.13.6 or later to resolve the issue...

PT-2019-10828 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.13.6 Description: The issue is related to multiple memory corruption problems that have been addressed through improved memory handling. Recommendations: For versions prior to 10.13.6, update to macOS High Sierra...

PT-2019-11336 · Jenkins · Jenkins Fortify On Demand Uploader Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify on Demand Uploader Plugin versions 3.0.10 and earlier Description: A cross-site request forgery issue allows attackers to initiate a connection to an attacker-specified server. Recommendations: For Jenkins Fortify on Demand...

PT-2019-2578 · Jenkins · Jenkins Script Security Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Script Security Plugin versions 1.55 and earlier Description: The issue is related to a sandbox bypass vulnerability in the Jenkins Script Security Plugin, which is caused by incorrect type conversion. This allows a remote attacker to...

KLA11450 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code and bypass security restrictions. Below is a complete list of vulnerabilities: 1. Buffer overflow vulnerability in IonMonkey JIT compiler can be exploited remotely t...

PT-2019-1903 · Apache +3 · Mod Auth Mellon +3

Name of the Vulnerable Software and Affected Versions: mod auth mellon versions prior to 0.14.2 Description: A vulnerability in mod auth mellon allows an open redirect in the logout URL, where requests with backslashes are treated as relative URLs, while browsers convert them to forward slashes,...

KLA11437 Multiple vulnerabilities in VMware products

Multiple vulnerabilities were found in VMware products. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. Vulnerability related to VMX process can be exploited remotely to gain privileges; 2. Vulnerability related to COM classes...

Embedded 7z vulnerable with a cvs score of 10

The embedded 7zip version is vulnerable. Please update...

PT-2019-16843 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1 Description: The issue is a buffer overflow that could allow an authenticated local attacker to execute arbitrary code on the system as root...

WinRAR <= 5.60 Out-of-Bounds Write Vulnerability

WinRAR is prone to an Out-of-Bounds Write vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

azure-umqtt-c vulnerable to denial-of-service (DoS)

Overview azure-umqtt-c contains a denial-of-service DoS vulnerability CWE-400. Masataka Sakaguchi, Bintatsu Noda and Hisashi Kojima of FUJITSU LABORATORIES LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

GHSA-856X-CP3Q-47VG Insecure Default Configuration in airbrake

Affected versions of airbrake default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive information...

Apache Traffic Server (ATS) sslheader Plugin Vulnerability

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Photon OS 2.0: Libgcrypt PHSA-2018-2.0-0091

An update of the libgcrypt package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0091. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2019-11316 · Jenkins · Jenkins Gitlab Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Authentication Plugin versions 0.29 and earlier Description: An exposure of sensitive information issue exists that allows attackers, who can view a Jenkins administrator's web browser output or control the browser, to retrieve...

Open-Xchange (OX) App Suite XSS Vulnerability (59653)

Attachment file names in mail can be used to inject script code, in case the victim uses Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

KLA11408 Multiple vulnerabilities in Apple iTunes

Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code, perform cross-site scripting attack. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability i...

PT-2019-6312

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 5.4.0 through 5.6.7 Fortinet FortiOS version 6.0.0 through 6.0.2 Fortinet FortiADC versions 5.4.0 through 6.1.0 Description An improper access control issue exists in Fortinet FortiOS and FortiADC. The issue allows an...

Joomla! Extension 'JCK Suite' - 'jckeditor' =< 6.4.4 Privilege Escalation

The Joomla! application running on the remote host has a version of 'JCK Suite' - 'jckeditor' extension that is prior or equal to 6.4.4. As such, the host is affected by a SQL injection SQLi vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacke...

PT-2019-5811 · Red Hat +1 · Red Hat +2

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Linux versions since v219-62.2 Description: A memory leak was discovered in the backport of fixes in Red Hat Enterprise Linux. The function dispatch message real in journald-server.c does not free the memory allocated by se...