SUSE SLES15 Security Update : nginx (SUSE-SU-2019:0334-1)

This update for nginx to version 1.14.2 fixes the following issues : Security vulnerabilities addressed : CVE-2018-16843 CVE-2018-16844: Fixed an issue whereby a client using HTTP/2 might cause excessive memory consumption and CPU usage bsc1115025 bsc1115022. CVE-2018-16845: Fixed an issue which...

SUSE-SU-2019:0334-1 Security update for nginx

This update for nginx to version 1.14.2 fixes the following issues: Security vulnerabilities addressed: - CVE-2018-16843 CVE-2018-16844: Fixed an issue whereby a client using HTTP/2 might cause excessive memory consumption and CPU usage bsc1115025 bsc1115022. - CVE-2018-16845: Fixed an issue whic...

chromium-browser: Insufficient policy enforcement in ServiceWorker

Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

PT-2019-1904 · Dovecot +5 · Dovecot +5

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.2.36.3 Dovecot versions 2.3.x prior to 2.3.5.1 Description: The issue is related to a lack of buffer size checks when reading FTS or POP3-UIDL headers from a Dovecot pointer. This can be exploited by a local attack...

Apache 2.4.x < 2.4.34 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.34. It is, therefore, affected by the following vulnerabilities: - By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a...

Remote Code Execution (RCE)

modperl is vulnerable to arbitrary code execution. There are no configuration options to allow administrator's control of HTTP request processing without also allowing unprivileged users to run Perl code on the system in the context of the Apache HTTPd process worker. This would allow an attacker...

Denial Of Service (DoS)

nginx is vulnerable to denial of service. It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if...

Google Chrome Payments Cross-Site Scripting Vulnerability

Google Chrome is a web browser developed by Google, Inc. Payments is one of the payment components. A security vulnerability exists in Payments in Google Chrome versions prior to 70.0.3538.67, which stems from the program's failure to perform strict origin detection. The vulnerability can be...

CVE-2018-20071

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

CVE-2018-20071

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

CVE-2018-20071

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

UBUNTU-CVE-2018-20071

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

CVE-2018-20071

Removed by vendor...

CVE-2018-20071

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

CVE-2018-20071

CVE-2018-20071 affects Google Chrome Payments: insufficiently strict origin checks during JIT payment app installation allowed a remote attacker to install a service worker for a domain hosting attacker-controlled files via a crafted HTML page. Affected: Payments component in Chrome prior to vers...

Google Chrome Serviceworker Information Disclosure Vulnerability

Google Chrome is the United States Google Google company developed a Web browser , ServiceWorker is one of the background messaging components . A security vulnerability exists in ServiceWorker in versions of Google Chrome prior to 66.0.3359.106, which stems from the program's lack of cross-origi...

Google Chrome Service Worker Information Disclosure Vulnerability

Google Chrome is a web browser developed by Google Google.Service Workers is a component that provides offline support for web applications. A security vulnerability exists in Service Worker in versions of Google Chrome prior to 66.0.3359.106, which stems from the program's lack of cross-domain...

CVE-2018-6089

A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page...

CVE-2018-6089

A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page...

UBUNTU-CVE-2018-6089

A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page...