SUSE-SU-2019:3393-1 Security update for python-azure-agent

This update for python-azure-agent fixes the following issues: Update to version 2.2.45 jscECO-80 bsc1159639 + Add support for Gen2 VM resource disks + Use alternate systemd detection + Fix /proc/net/route requirement that causes errors on FreeBSD + Add cloud-init auto-detect to prevent multiple...

CVE-2019-7184

This cross-site scripting XSS vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions...

The vulnerability of Modicon microprogrammed controllers lies in the lack of version checking for installed software updates. This allows a malicious individual to download an unpatched version of the installed software via FTP, thereby causing a service failure.

The vulnerability of Modicon microprogrammed controllers lies in the lack of verification of the version of the embedded software updates. Exploiting this vulnerability allows a malicious actor to download an un-supported version of the embedded software via FTP protocol, thereby causing service...

PT-2019-6065

Name of the Vulnerable Software and Affected Versions QNAP Photo Station affected versions not specified Description This issue is related to improper access control, allowing remote attackers to gain unauthorized access to the system. The exploitation of this issue can lead to unauthorized syste...

SUSE-SU-2019:2686-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Updated to version 6.2.7.1. Security issues fixed: - CVE-2019-9854: Fixed unsafe URL assembly flaw bsc1149944. - CVE-2019-9855: Fixed path equivalence handling flaw bsc1149943...

OPENSUSE-SU-2019:2286-1 Security update for lxc

This update for lxc fixes the following issues: Update to lxc 3.2.1. The changelog can be found at https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322 + seccomp: support syscall forwarding to userspace + add lxc.seccomp.allownesting + pidfd: Add initial support for the new pidf...

PT-2019-5209 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to an error in the shortcode preview functionality of the WordPress content management system, allowing for XSS attacks. This could potentially enable a remote attacker to...

PT-2019-7062 · WordPress · Wp-Live-Chat-Support

Name of the Vulnerable Software and Affected Versions: wp-live-chat-support plugin versions prior to 4.1.0 Description: The issue concerns JavaScript injections in the wp-live-chat-support plugin for WordPress. Recommendations: For versions prior to 4.1.0, update to version 4.1.0 or later to...

PT-2019-11782 · Jenkins · Jenkins Relution Enterprise Appstore Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Relution Enterprise Appstore Publisher Plugin versions 1.24 and earlier Description: A cross-site request forgery issue allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server. Recommendations: For...

PT-2019-7207 · Apache +2 · Apache Activemq +2

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ client versions prior to 5.15.5 Description: A remote shutdown command in the ActiveMQConnection class was exposed, allowing an attacker logged into a compromised broker to achieve denial of service on a connected client...

Multiple vulnerabilities in Cybozu Garoon

Overview Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. DOM-based cross-site scripting in the application "Portal" CWE-79 - CVE-2019-5975 Denial-of-service DoS CWE-20 - CVE-2019-5976 Mail header injection in the application "E-mail" CWE-74 - CVE-2019-5977...

PT-2019-16486 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.16 and prior Description: The issue allows a high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in the unauthorized ability to cause a hang o...

PT-2019-17999 · Lenovo · Lenovo Service Bridge

Name of the Vulnerable Software and Affected Versions: Lenovo Service Bridge versions prior to 4.1.0.1 Description: A vulnerability in Lenovo Service Bridge could allow remote code execution. Recommendations: For versions prior to 4.1.0.1, update to version 4.1.0.1 or later to resolve the issue...

PT-2019-2927 · Mysql Server +4 · Mysql Connector/J +4

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x before 2.9.9 Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the service has the...

OPENSUSE-SU-2019:1372-1 Security update for sqlite3

This update for sqlite3 to version 3.28.0 fixes the following issues: Security issues fixed: - CVE-2019-9936: Fixed a heap-based buffer over-read, when running fts5 prefix queries inside transaction bsc1130326. - CVE-2019-9937: Fixed a denial of service related to interleaving reads and writes in...

Pre-Installed Software Flaw Exposes Most Dell Computers to Remote Hacking

If you use a Dell computer, then beware — hackers could compromise your system remotely. Bill Demirkapi, a 17-year-old independent security researcher, has discovered a critical remote code execution vulnerability in the Dell SupportAssist utility that comes pre-installed on most Dell computers...

PT-2019-11971 · Grandstream · Grandstream Gwn7610

Name of the Vulnerable Software and Affected Versions: Grandstream GWN7610 versions prior to 1.0.8.18 Description: The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a "/ubus/controller.icc.update nds webroot from tmp" API call,...

JVN#11622218: iChain Insurance Wallet App for iOS vulnerable to directory traversal

iChain Insurance Wallet App for iOS provided by iChain, Inc. uses the old version of cordova-plugin-ionic-webview, and inherits a directory traversal vulnerability CWE-22, CVE-2018-16202. Impact A remote attacker may obtain an arbitrary file such as a file related to an application on iOS device...

PT-2019-1538 · Cisco · Cisco Webex Teams

Name of the Vulnerable Software and Affected Versions: Cisco Webex Teams versions prior to 3.13.26920 Description: The issue is related to improper input validation in the client application, allowing an authenticated, remote attacker to upload arbitrary files within the scope of the iOS...

Arbitrary File Write in cli

Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to. Proof of Concept By...