CVE-2019-14261

An issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices. Due to an insufficient implementation of jamming detection, an attacker is able to suppress correctly received RF messages sent between wireless peripheral components, e.g., wireless detectors or remote controls, and the ABUS...

GitLab Authorization Issues Vulnerability (CNVD-2019-31314)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab...

Cisco Integrated Management Controller DoS

The vulnerability of the Cisco Integrated Management Controller, a software-based remote server management system, exists due to insufficient verification of input data. Exploiting this vulnerability could allow an attacker to cause service interruptions through a specially crafted HTTP request...

Cisco Enterprise NFV Infrastructure Software Web Interface Access

The vulnerability of the Cisco Enterprise NFV Infrastructure Software’s software infrastructure management web interface is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain limited access to the management web interface...

Smart Tunnel Privilege Escalation

The vulnerability of the Smart Tunnel component of the microprogramming software for Cisco Adaptive Security Appliances is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

Weak Password Vulnerability in Tianqing Web Application Security Gateway

SkyQuest Web Application Security Gateway is a new generation of Web security protection and application delivery application security product developed by Qisda, which is used to defend against attacks targeting Web application vulnerabilities, analyze HTTP/HTTPS traffic on Web servers and...

SyncController.dll RCE

The vulnerability of the SyncController.dll library on the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute arbitrary code through a specially created application...

Cisco IMC Session Token Privilege Escalation

The vulnerability of the Cisco Integrated Management Controller IMC Supervisor web interface, as well as the tools for managing physical infrastructure and virtual environments such as Cisco UCS Director and Cisco UCS Director Express for Big Data, is related to authentication procedures that hav...

curl: Heap buffer overflow in TFTP when using small blksize

Summary: With a TFTP server that does not send OACK, but instead starts anyway with first block with 512 bytes block size, the curl library fails to assume default 512 bytes blocks. Instead it detects EOF and does not return an error code. Consequence is a truncated file that is 512 bytes without...

CVE-2019-10059: Undefined Security Weakness

The legacy finger service TCP port 79 is enabled by default on various older Lexmark devices...

PT-2019-4021

Name of the Vulnerable Software and Affected Versions «Безопасный город» affected versions not specified Description The issue is related to weaknesses in the authorization mechanisms of the electronic interaction module for services and officials of the «Безопасный город» hardware-software...

CVE-2019-15325: Undefined Security Weakness

In GalliumOS 3.0, CONFIGSECURITYYAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptracescope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not...

cPanel Authorization Issues Vulnerability (CNVD-2019-29008)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An authorization issue vulnerability exists in versions prior to cPanel 57.9999.54. The vulnerability stems from a lack of...

CVE-2019-4338

IBM Security Guardium Big Data Intelligence 4.0 SonarG does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417...

CVE-2019-11209: Undefined Security Weakness

The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1;...

CVE-2019-9010: Undefined Security Weakness

An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of...

CVE-2014-10375: Undefined Security Weakness

handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...

Kernel: page cache side channel attacks

A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be us...

PT-2019-3052 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an elevation of privilege in SyncController.dll, allowing an attacker to run arbitrary code with elevated privileges. To exploit this, an attacker would need to run ...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0070)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - Integer overflow in the aiosetupsinglevector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibl...