glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress

filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

OpenSSL Information Disclosure Vulnerability (CNVD-2019-38485)

OpenSSL is an open source capable general-purpose cryptographic library from the OpenSSL team that implements the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. The product supports a variety of cryptographic algorithms , including symmetric ciphers , hash algorithms ,...

PT-2019-17114 · Ibm · Ibm Security Key Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Key Lifecycle Manager versions 2.6 through 3.0.1 Description: The issue discloses sensitive information to unauthorized users, which can be used to mount further attacks on the system. Recommendations: For versions 2.6 through...

CVE-2019-4280

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IBM X-Force ID: 160503...

IBM Sterling File Gateway Information Disclosure Vulnerability (CNVD-2019-34605)

IBM Sterling File Gateway is a suite of file transfer software from IBM in the United States. The software integrates different centers of file transfer activity and facilitates the secure exchange of file-based data over the Internet. An information disclosure vulnerability exists in IBM Sterlin...

QEMU: qxl: null pointer dereference while releasing spice resources

interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...

CVE-2019-11663

Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure...

jolokia: system-wide CSRF that could lead to Remote Code Execution

A flaw was found in Jolokia, versions 1.2 through 1.6.0, where Jolokia did not correctly handle checking for origin and referrer headers when strict checking was enabled. An attacker could use this vulnerability to conduct cross-site request forgery or further attacks...

CVE-2019-5481

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3...

PT-2019-16927 · Ibm · Ibm Sterling File Gateway

Name of the Vulnerable Software and Affected Versions: IBM Sterling File Gateway versions 2.2.0.0 through 6.0.1.0 Description: The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end databas...

CVE-2019-5976

Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors...

Google Android System Information Disclosure Vulnerability (CNVD-2019-30317)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An information disclosure vulnerability exists in the System component of Google Android 7.1.1, 7.1.2, 8.0, 8.1, and 9. An attacker can exploit the vulnerability to...

GitLab Omnibus Privilege Vulnerability

Omnibus GitLab is a package of different services and tools needed to run GitLab from GitLab USA. GitLab Omnibus An elevation of privilege vulnerability exists in GitLab versions 7.4 through 12.2.1, which can be exploited by an attacker to elevate privileges...

PT-2019-17082 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 2018.1 through 2018.4.1.6 Description: The issue may cause sensitive details about internal servers and network to be leaked via API swagger. Recommendations: For versions 2018.1 through 2018.4.1.6, consider restricti...

3CX Phone system (web) management console code issue vulnerability

3CX Phone system web management console is a web-based management console program for the 3CX phone system. A code issue vulnerability exists in 3CX Phone system web management console versions 12.5.44178.1002 through 12.5 SP2. The vulnerability arises from an improperly designed or implemented...

DEBIAN-CVE-2019-13105

Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem...

Jolokia Cross-Site Request Forgery Vulnerability (CNVD-2019-26164)

Jolokia is a use of JSON via Http to achieve JMX remote management of open source projects , it provides JMX batch operation , security policies and so on. A cross-site request forgery vulnerability exists in Jolokia versions 1.2.0 through 1.6.0. The vulnerability stems from a WEB application tha...

Magento cross-site scripting vulnerability (CNVD-2019-26244)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A cross-site scripting vulnerability exists in the admin panel in Magento versions 2.1.18 before 2.1, 2.2.9 befor...

PT-2019-17011 · Ibm · Ibm Jazz For Service Management

Name of the Vulnerable Software and Affected Versions: IBM Jazz for Service Management versions 1.1.3 through 1.1.3.2 Description: The issue could allow an unauthorized local user to create unique catalog names, potentially causing a denial of service. Recommendations: For versions 1.1.3 through...