6867 matches found
Adobe Flash Player, Reader, and Acrobat 'authplay.dll' Remote Code Execution Vulnerability
Description Adobe Flash Player, Reader, and Acrobat are prone to a remote code execution vulnerability. Adobe reports that this vulnerability is being exploited in the wild. This vulnerability is present in the following versions: Flash Player 10.0.45.2, 9.0.262, and earlier Flash Player 10.0.x a...
Symantec Products Autonomy KeyView Module Vulnerability
SUMMARY Symantec products that ship a third-party Autonomy KeyView module have updated the module to address a vulnerability in the processing of Excel spreadsheets reported against the KeyView module. AFFECTED PRODUCTS Product | Version | Build | Solutions ---|---|---|--- Symantec Mail Security...
Microsoft Windows AFD Driver Local Privilege Escalation Vulnerability
Description Microsoft Windows is prone to a local privilege-escalation vulnerability in the Ancillary Function Driver 'afd.sys'. A successful exploit of this vulnerability will let a local attacker completely compromise an affected computer. Technologies Affected Microsoft Windows Server 2003...
Microsoft Windows Help File Unspecified Heap Overflow Vulnerability
Description The Microsoft Windows Help File viewer is reported prone to a heap-overflow vulnerability because it fails to perform boundary checks before copying user-supplied data into insufficiently sized memory buffers. This vulnerability presents itself when the application handles a specially...
Microsoft Internet Explorer Secure Sockets Layer Caching Vulnerability
Description Microsoft Internet Explorer is reported prone to a Secure Sockets Layer caching vulnerability. It is reported that arbitrary content may be cached to the computer that is viewing a malicious site when this vulnerability is exploited. This cached content will be rendered in the context...
CSRF Token Information Disclosure in MC
Summary The Management Center MC web UI is susceptible to a CSRF token disclosure vulnerability. A remote attacker, who has access to an authenticated MC user's web browser history or a network device that intercepts/logs traffic to MC, can obtain CSRF tokens and use them to perform CSRF attacks...
Oracle Java SE/Java SE Embedded CVE-2020-2601 Remote Security Vulnerability
Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over 'Kerberos' protocol. This issue affects the 'Security' component. This vulnerability affects the following supported versions: Java SE: 7u241, 8u231, 11.0.5, 13.0....
Oracle Hospitality Cruise Materials Management CVE-2020-2599 Local Security Vulnerability
Description Oracle Hospitality Cruise Materials Management is prone to a local security vulnerability. This issue affects the 'MMS All' component. This vulnerability affects the following supported version: 7.30.567 Technologies Affected Oracle Hospitality Cruise Materials Management 7.30.567...
Microsoft Windows Common Log File System CVE-2020-0615 Local Information Disclosure Vulnerability
Description Microsoft Windows is prone to a a local information-disclosure vulnerability. Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Versio...
Oracle MySQL Server CVE-2020-2580 Remote Security Vulnerability
Description Oracle MySQL Server is prone to a remote security vulnerability in 'Server: DDL' component. The vulnerability can be exploited over the 'MySQL' protocol. This vulnerability affects the following supported versions: 8.0.17 and prior Technologies Affected Oracle MySQL Server 8.0.11 Orac...
Cloud Foundry Cloud Controller API CVE-2019-11294 Access Control Security Bypass Vulnerability
Description Cloud Foundry Cloud Controller API is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. Cloud Foundry Cloud Controller API 1.88.0 is vulnerable...
IBM Spectrum Scale CVE-2019-4558 Local Privilege Escalation Vulnerability
Description IBM Spectrum Scale is prone to a local privilege-escalation vulnerability. An attacker may exploit this issue to gain root privileges. The following IBM products are affected: IBM Spectrum Scale versions 5.0.0.0 through 5.0.3.2 and 4.2.0.0 through 4.2.3.17 are vulnerable. IBM Elastic...
Microsoft Windows GDI Component CVE-2019-1465 Information Disclosure Vulnerability
Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 16...
Atlassian Companion CVE-2019-15006 Security Bypass Vulnerability
Description Atlassian Companion is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions or conduct man-in-the-middle attack; this may aid in launching further attacks. Technologies Affected Atlassian...
Multiple Kaspersky Products CVE-2019-15689 DLL Loading Arbitrary Code Execution Vulnerability
Description Multiple Kaspersky Products are prone to an arbitrary code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial of service condition. The following products ar...
Ansible CVE-2019-14905 OS Command Injection Vulnerability
Description Ansible is prone to an OS command-injection vulnerability. An attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. Versions prior to Ansible 2.9.2, 2.8.8 and 2.7.16 are vulnerable...
IBM Sterling B2B Integrator CVE-2019-4387 SQL Injection Vulnerability
Description IBM Sterling B2B Integrator is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...
Joomla! Core Multiple SQL Injection and Information Disclosure Vulnerabilities
Description Joomla! Core is prone to an information-disclosure vulnerability and SQL-injection vulnerability. An attacker can exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and gain access to sensitive...
McAfee Client Proxy CVE-2019-3654 Local Authentication Bypass Vulnerability
Description McAfee Client Proxy is prone to a local authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism. This may aid in further attacks. McAfee Client Proxy MCP versions prior to 3.0.0 are vulnerable. Technologies Affected McAfee Client...
F5 BIG-IP APM CVE-2019-6661 Denial of Service Vulnerability
Description F5 BIG-IP APM is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause excessive resource consumption, resulting in a denial-of-service condition. BIG-IP APM 14.1.0 through 14.1.2, 14.0.0 through 14.0.1, 13.0.0 through 13.1.3, 12.1.0 through 12.1.4, and...
Lenovo ThinkPad CVE-2019-6172 Remote Code Execution Vulnerability
Description Lenovo is prone to a remote code-execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Technologies Affected Lenovo Thinkpad Recommendations Block external access at the network boundary, unle...
Microsoft Windows Hyper-V CVE-2019-1310 Denial of Service Vulnerability
Description Microsoft Windows is prone to a denial of service vulnerability. An attacker can exploit this issue to crash the host machine, resulting in a denial of service condition. Technologies Affected Microsoft Hyper-V Microsoft Windows 10 Version 1803 for x64-based Systems Microsoft Windows ...
Microsoft Windows AppX Deployment Extensions CVE-2019-1385 Local Privilege Escalation Vulnerability
Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft Windows 10 Version 1709 for ARM64-based Systems Microsoft Windows 10 Version 1803 for 32-bit Systems Microsoft...
Intel Ethernet 700 Series Controllers CVE-2019-0140 Buffer Overflow Vulnerability
Description Intel Ethernet 700 Series Controllers are prone to a buffer-overflow vulnerability. An attacker can exploit this issue to obtain elevated privileges that may aid in further attacks. Intel Ethernet 700 Series Controllers versions prior to 7.0 are vulnerable. Technologies Affected Citri...
Artifex Ghostscript CVE-2019-14869 Remote Privilege Escalation Vulnerability
Description Ghostscript is prone to a remote privilege-escalation vulnerability. A remote attacker can exploit this issue to gain elevated privileges and access arbitrary files or execute arbitrary commands on the affected system. Versions prior to Ghostscript 9.50 are vulnerable. Technologies...
Xen CVE-2019-18421 Privilege Escalation Vulnerability
Description Xen is prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges, obtain sensitive information or cause denial-of-service conditions. Technologies Affected Citrix Hypervisor 8.0 Citrix XenServer 7.0 Citrix XenServer 7.1 LTSR CU2 Citr...
CODESYS ENI Server CVE-2019-16265 Stack Buffer Overflow Vulnerability
Description CODESYS ENI Server is prone to a stack-based buffer-overflow vulnerability. Exploiting this issue may allow remote attackers to execute arbitrary code within the context of the affected application. Failed attacks will cause denial-of-service conditions. CODESYS ENI Server versions...
Cisco TelePresence CE Software CVE-2019-15277 Local Privilege Escalation Vulnerability
Description Cisco TelePresence Collaboration Endpoint Software is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary commands with root level privileges. This issue is being tracked by Cisco Bug ID CSCvp93715. Versions prior to Cisco...
Cisco Aironet Access Points CVE-2019-15261 Denial of Service Vulnerability
Description Cisco Aironet Access Points is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition. This issue is being tracked by Cisco Bug ID CSCvk79807. Technologies Affected Cisco Aironet 1810 Series Access Points Cisco Aironet 183...
Oracle E-Business Suite CVE-2019-2930 Remote Security Vulnerability
Description Oracle E-Business Suite is prone to a remote security vulnerability in Oracle Field Service. The vulnerability can be exploited over the 'HTTP' protocol. The 'Wireless' component is affected. This vulnerability affects the following supported versions: 12.1.1 through 12.1.3 and 12.2.3...
Joomla! Core CVE-2019-18650 Cross Site Request Forgery Vulnerability
Description Joomla! is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks. Joomla! 3.2.0 through 3.9.12 are vulnerable. Technologies...
Juniper Junos CVE-2019-0055 Denial of Service Vulnerability
Description Juniper Junos is prone to a denial-of-service vulnerability. An attacker may exploit this issue to cause denial-of-service conditions. Technologies Affected Juniper Junos 12.3X48 Juniper Junos 12.3X48-D10 Juniper Junos 12.3X48-D15 Juniper Junos 12.3X48-D20 Juniper Junos 12.3X48-D25...
Juniper Junos CVE-2019-0060 Denial of Service Vulnerability
Description Juniper Junos is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a process crash, denying service to legitimate users. The following versions of Juniper Junos are affected: Juniper Junos 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180 are...
Palo Alto Networks Zingbox Inspector CVE-2019-1584 Remote Code Execution Vulnerability
Description Palo Alto Networks Zingbox Inspector is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the affected system. Palo Alto Networks Zingbox Inspector version 1.293 and prior are vulnerable. Technologies...
Microsoft Windows JET Database Engine CVE-2019-1250 Remote Code Execution Vulnerability
Description Microsoft Windows JET Database Engine is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10...
Microsoft Office CVE-2019-1264 Security Bypass Vulnerability
Description Microsoft Office is prone to a security bypass vulnerability. An attacker can leverage this issue to bypass certain security restrictions; this may aid in launching further attacks. Technologies Affected Microsoft Office 2010 Service Pack 2 32-bit editions Microsoft Office 2010 Servic...
Microsoft SharePoint CVE-2019-1295 Remote Code Execution Vulnerability
Description Microsoft SharePoint is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected Microsoft SharePoint Enterprise Server 2016 Microsof...
Microsoft Windows Hyper-V CVE-2019-0715 Denial of Service Vulnerability
Description Microsoft Windows is prone to a denial of service vulnerability. An attacker can exploit this issue to crash the host machine, resulting in a denial of service condition. Technologies Affected Microsoft Hyper-V Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows ...
Microsoft Windows Graphics Component CVE-2019-1150 Remote Code Execution Vulnerability
Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits may allow an attacker to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Windows 10...
Microsoft Edge Chakra Scripting Engine CVE-2019-1001 Remote Memory Corruption Vulnerability
Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore Microsoft...
Microsoft Edge Chakra Scripting Engine CVE-2019-1103 Remote Memory Corruption Vulnerability
Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore Microsoft...
Microsoft Team Foundation Server CVE-2019-0777 Cross Site Scripting Vulnerability
Description Microsoft Team Foundation Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...
Microsoft Windows GDI Component CVE-2019-0660 Information Disclosure Vulnerability
Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 16...
Microsoft Windows JET Database Engine CVE-2019-0577 Remote Code Execution Vulnerability
Description Microsoft Windows JET Database Engine is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10...
Microsoft Windows GDI Component CVE-2018-8422 Information Disclosure Vulnerability
Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems...
Microsoft Windows Kernel 'Win32k.sys' CVE-2018-8399 Local Privilege Escalation Vulnerability
Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with elevated privileges. This can result in the attacker gaining complete control of the affected system. Technologies Affected Microsoft Windows 10...
Microsoft Internet Explorer and Edge CVE-2018-8385 Remote Memory Corruption Vulnerability
Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Successfully exploiting this issue allows remote attackers to execute arbitrary code in t...
Microsoft Windows Mail Client CVE-2018-8305 Information Disclosure Vulnerability
Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Mail and Calendar Microsoft People Recommendations Block external access at the...
Redis CVE-2018-12453 Remote Denial Of Service Vulnerability
Description Redis is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service condition. Redis version prior to 5.0 are vulnerable. Technologies Affected Redhat Ceph Storage 3 Redhat Mobile Application Platform 4 Redis Redis 2.8.21 Redis Red...
SA167: SAML Authentication Bypass
SUMMARY When configured to authenticate network users with a SAML authentication realm, Symantec ASG and ProxySG incorrectly handle SAML responses that have XML nodes with comments. A remote attacker can modify a valid SAML response without invalidating its cryptographic signature to bypass SAML...