CVE-2019-6821

CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum...

Design/Logic Flaw

CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum...

python-jinja2: Sandbox escape due to information disclosure via str.format

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...

CVE-2019-6821: Use of Insufficiently Random Values

CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum...

WordPress Virim Deserialization Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Virim plugin is used in one of the website social activity analysis plugin. Virim plugin 0.4 for WordPress allows unsafe deserializatio...

python-jinja2: Sandbox escape due to information disclosure via str.format

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...

Schneider Electric Modicon Controllers

1. EXECUTIVE SUMMARY CVSS v3 5.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: Modicon M580, Modicon M340, Modicon Premium, and Modicon Quantum Vulnerability: Use of Insufficiently Random Values 2. RISK EVALUATION Successful exploitation of this...

SUSE-SU-2019:1238-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2019-9824: Fixed an information leak in slirp bsc1129622 - CVE-2019-8934: Added method to specify whether or not to expose certain ppc64 host information, which can be considered a security issue bsc1126455 - CVE-2019-3812: Fixed OOB memory...

CVE-2018-20200

CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale...

UBUNTU-CVE-2019-10130

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain...

CVE-2019-11840: Use of Insufficiently Random Values

An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa packages. If more than 256 GiB of keystream i...

Schneider Electric Modicon M241 and M251 PLCs Insufficiently Random Values

Binary data 720114.prm...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2019:1181-1)

This update for freeradius-server fixes the following issues : Security issues fixed : CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. CVE-2019-11234: Fixed an authentication bypass caused by...

Rockwell Automation Micrologix 1400 <= 21.2 User Fault Routine Exploit

Binary data 720222.prm...

Rockwell Automation Micrologix 1400 <= 21.2 Ladder Logic Overwrite

Binary data 720216.prm...

Mozilla: Improper bounds checks when Spectre mitigations are disabled

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully...

CVE-2019-11690

genranduuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIGRANDOMUUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device...

CVE-2019-11690: Use of Insufficiently Random Values

genranduuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIGRANDOMUUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device...

Improper Validation

Thunderbird, Firefox ESR, and Firefox are vulnerable to improper validation. A remote user can read uninitialized values when parsing application/http-index-format content leading to this flaw...

SUSE SLED15 / SLES15 Security Update : freeradius-server (SUSE-SU-2019:1086-1)

This update for freeradius-server fixes the following issues : Security issues fixed : CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. CVE-2019-11234: Fixed an authentication bypass caused by...