6867 matches found
Microsoft Office Web Components ActiveX Control Stack Buffer Overflow Code Execution Vulnerability
Description The Microsoft Office Web Components ActiveX control is prone to a remote stack-based buffer-overflow vulnerability. An attacker could exploit this issue by enticing a victim to visit a maliciously crafted webpage. Successful exploits will allow the attacker to execute arbitrary code...
Symantec Log Viewer JavaScript Injection Vulnerabilities
SUMMARY The Log Viewer feature in some Symantec products contains two parsing errors which could be exploited through Java script injection. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Norton 360 | 1.0 | Run LiveUpdate in Interactive Mode Norton Internet Security | 2005 through 200...
Symantec Brightmail Gateway and Mail Security Appliance Cross-site Scripting and Elevation of Privil
SUMMARY Symantec Brightmail Gateways Control Center is susceptible to cross-site scripting and elevation of privilege vulnerabilities. AFFECTED PRODUCTS Product | Version | Solutions ---|---|--- Symantec Brightmail Gateway Appliance 8300 | All prior to 8.0.1 | Upgrade to 8.0.1 or later Symantec...
Microsoft Windows Active Directory LDAP Request Handling Remote Code Execution Vulnerability
Description Microsoft Windows Active Directory is prone to a remote code-execution vulnerability that arises because the application fails to handle specially crafted LDAP or LDAP over SSL LDAPS requests in a proper manner. Successfully exploiting this issue would allow an attacker to execute...
Symantec Device Driver Local Elevation of Privilege
SUMMARY A Gear Software device driver distributed with several Symantec products contains a flaw which, if successfully exploited, could allow a local elevation of privilege. Risk Impact Medium Remote Access adjacent network | No ---|--- Local Access | Yes Authentication Required | Yes Exploit...
Microsoft Windows Recursive DNS Spoofing Vulnerability
Description Microsoft Windows DNS Server is prone to a vulnerability that permits an attacker to spoof responses to DNS requests. A successful attack will corrupt the DNS cache with attacker-specified content. This may aid in further attacks such as phishing. Technologies Affected Avaya Messaging...
Microsoft Antivirus Engine Integer Overflow Vulnerability
Description Microsoft Antivirus Engine is prone to an integer-overflow vulnerability when the application processes maliciously crafted files. This issue is currently being exploited via Portable Document Files PDF, but other Microsoft applications are also reported vulnerable. An attacker could...
Microsoft GDI+ Library JPEG Segment Length Integer Underflow Vulnerability
Description Microsoft Graphics Device Interface GDI+ JPEG handler is reported prone to an integer underflow vulnerability when handling JPEG format images. This issue presents itself due to a lack of sufficient sanity checks performed on certain JPEG data before this data employed as a bounds val...
Microsoft Windows Local Descriptor Table Local Privilege Escalation Vulnerability
Description Microsoft Windows Local Descriptor Table programming interface is prone to a privilege-escalation vulnerability. A local attacker may be able to create a malicious entry in the Local Descriptor Table. This entry may point into protected memory. Since this memory space is reserved for...
Microsoft Internet Explorer PNG Deflate Heap Corruption Vulnerability
Description A heap corruption vulnerability has been reported for Microsoft Internet Explorer. The vulnerability is related to the way that Microsoft Internet Explorer interprets PNG image data. The function that handles the deflation of PNG images does not properly handle some invalid data withi...
Data Center Security Privilege Escalation
Summary Symantec has released an update to address an issue that was discovered in the Data Center Security Manager component. Affected Products Data Center Security Manager Component --- CVE | Affected Versions | Remediation CVE-2020-5832 | Prior to 6.8.2 aka 6.8 MP2 | Upgrade 6.8.2 aka 6.8 MP2...
Microsoft Windows Search Indexer CVE-2020-0629 Local Privilege Escalation Vulnerability
Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for...
Adobe Experience Manager APSB20-01 Multiple Cross Site Scripting Vulnerabilities
Description Adobe Experience Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affecte...
Oracle Identity Manager CVE-2020-2728 Remote Security Vulnerability
Description Oracle Identity Manager is prone to a remote security vulnerability. The vulnerability can be exploited over the 'HTTP' protocol. The 'OIM - LDAP user and role Synch' component is affected. This vulnerability affects the following supported versions: 12.2.1.3.0 Technologies Affected...
Oracle Banking Payments cpujan2020 Multiple Security Vulnerabilities
Description Oracle Banking Payments is prone to multiple security vulnerabilities. The vulnerability can be exploited over the 'HTTP' protocol. The 'Payments Core' component is affected. These vulnerabilities affect the following supported versions: 14.1.0 through 14.3.0 Technologies Affected...
Juniper Junos CVE-2020-1604 Security Bypass Vulnerability
Description Juniper Junos is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. The following products are affected: Juniper Junos 14.1X53 versions prior to...
Trend Micro Apex Central CVE-2019-19692 Cross Site Scripting Vulnerability
Description Trend Micro Apex Central is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Thi...
Rack CVE-2019-16782 Information Disclosure Vulnerability
Description Rack is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Rack Project Rack 0.1 Rack Project Rack 0.2 Rack Project Rack 0.3 Rack Project Rack 0.4 Rack Project Rack...
Drupal Core SA-CORE-2019-011 Access Bypass Vulnerability
Description Drupal is prone to an access-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Drupal versions 8.7.x and 8.8.x are vulnerable. Technologies Affected Drupal Drupa...
Omron PLC CJ/CS/NJ Series CVE-2019-18261 Authentication Bypass Vulnerability
Description Omron PLC CJ, CS and NJ Series are prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and aid in brute-force attacks; other attacks may also be possible. The following products of Omron Programmable Logic...
Microsoft Windows Printer Service CVE-2019-1477 Local Privilege Escalation Vulnerability
Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1809 for 32-bit Systems Microsoft Windows 10 Version...
Microsoft Visual Studio CVE-2019-1486 Spoofing Vulnerability
Description Microsoft Visual Studio is prone to an security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Visual...
Siemens SIMATIC Products CVE-2019-10929 Man in the Middle Security Bypass Vulnerability
Description Multiple Siemens SIMATIC Products are is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. The following Siemens products are affected: Siemens SIMATIC CP...
Linux Kernel CVE-2019-19525 Local Denial of Service Vulnerability
Description Linux Kernel is prone to a local denial-of-service vulnerability. Local attackers can exploit this issue to cause denial-of-service conditions. Linux Kernel versions prior to 5.3.6 are vulnerable. Technologies Affected Linux kernel 2.0.0 Linux kernel 2.0.1 Linux kernel 2.0.10 Linux...
F5 BIG-IP Traffic Management Microkernel CVE-2019-6667 Denial of Service Vulnerability
Description F5 BIG-IP is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause the resource exhaustion resulting in a denial-of-service condition. Technologies Affected F5 BIG-IP AAM 11.5.1 F5 BIG-IP AAM 11.6.0 F5 BIG-IP AAM 11.6.5 F5 BIG-IP AAM 12.1.0 F5...
IBM Case Manager CVE-2019-4426 Cross Site Scripting Vulnerability
Description IBM Case Manager is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the...
Xen CVE-2019-19579 Incomplete Fix Local Privilege Escalation Vulnerability
Description Xen is prone to a local privilege-escalation vulnerability. Local attacker can exploit this issue to gain elevated privileges on affected computers. Technologies Affected Xen Xen 3.0.2 Xen Xen 3.0.3 Xen Xen 3.0.4 Xen Xen 3.1 Xen Xen 3.1.3 Xen Xen 3.1.4 Xen Xen 3.2.0 Xen Xen 3.2.1 Xen...
Multiple QNAP Products NAS-201911-25 Multiple Security Vulnerabilities
Description Multiple QNAP products are prone to multiple security vulnerabilities. An attacker can exploit these issues to gain unauthorized access to the affected device, inject and execute arbitrary code and read or write arbitrary files on the device. Technologies Affected Qnap Photo Station...
Multiple Pivotal RabbitMQ Products CVE-2019-11291 Cross Site Scripting Vulnerability
Description Multiple Pivotal RabbitMQ products are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected...
Microsoft Office CVE-2019-1442 Security Bypass Vulnerability
Description Microsoft Office is prone to a security bypass vulnerability. An attacker can leverage this issue to bypass certain security restrictions; this may aid in launching further attacks. Technologies Affected Microsoft SharePoint Server 2019 Recommendations Run all software as a...
Microsoft Windows Graphics Component CVE-2019-1435 Local Privilege Escalation Vulnerability
Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft...
Microsoft Visual Studio CVE-2019-1425 Remote Privilege Escalation Vulnerability
Description Microsoft Visual Studio is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft Visual Studio 2017 15.9 Microsoft Visual Studio 2019 16.0 Microsoft Visual Studio 2019 16.3 Recommendations...
Redhat Quay CVE-2019-3865 HTML Injection Vulnerability
Description Redhat Quay is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-bas...
Xen CVE-2019-18423 Denial of Service Vulnerability
Description Xen is prone to a denial-of-service vulnerability. An attacker can exploit this issue to crash hypervisor, denying service to legitimate users. Xen version 4.8 and later are vulnerable. Technologies Affected Xen Xen 4.10 Xen Xen 4.10.0 Xen Xen 4.10.1 Xen Xen 4.10.2 Xen Xen 4.11.0 Xen...
Multiple IBM Products CVE-2019-4394 Local Security Vulnerability
Description Multiple IBM Products are prone to a local security vulnerability. Successfully exploiting this issue will allow attackers to perform unauthorized actions; this may aid in launching further attacks. Technologies Affected IBM Cloud Orchestrator 2.4 IBM Cloud Orchestrator 2.4.0.1 IBM...
Cloud Foundry UAA CVE-2019-11282 Information Disclosure Vulnerability
Description Cloud Foundry UAA is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. Cloud Foundry UAA versions prior to 74.3.0 are vulnerable. Technologies Affected Cloud Foundry UAA 63.0...
Golang Go CVE-2019-17596 Remote Denial of Service Vulnerability
Description Golang Go is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition. Versions prior to Go 1.13.2 and Go 1.12.11 are vulnerable. Technologies Affected golang Go 1.12.1 golang Go 1.12.10 golang Go 1.12.5 golang Go...
Oracle E-Business Suite CVE-2019-3027 Remote Security Vulnerability
Description Oracle E-Business Suite is prone to a remote security vulnerability in 'Oracle Application Object Library' product. This vulnerability can be exploited over the 'HTTP' protocol. The 'Login Help' component is affected. This vulnerability affects the following supported versions: 12.2.5...
Nessus CVE-2019-3982 Denial of Service Vulnerability
Description Nessus is prone to a denial-of-service vulnerability. Attackers may leverage this issue to cause a denial-of-service condition. Nessus versions 8.6.0 and prior are vulnerable. Technologies Affected Tenable Nessus 1.0.1 Tenable Nessus 3.0.3 Tenable Nessus 4.0 Tenable Nessus 4.4.1 Tenab...
Juniper Junos CVE-2019-0054 Certificate Validation Security Weakness
Description Juniper Junos is prone to a security weakness. An attacker can exploit this issue to perform man-in-the-middle attacks and perform certain unauthorized actions, which will aid in further attacks. Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D120 are vulnerable...
Juniper Junos CVE-2019-0061 Local Privilege Escalation Vulnerability
Description Juniper Junos is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to gain elevated privileges. The following versions of Juniper Junos are affected: Junper Junos 15.1X49 versions prior to 15.1X49-D171 and 15.1X49-D180 Junper Junos 15.1X53...
Juniper Junos CVE-2019-0051 Denial of Service Vulnerability
Description Juniper Junos is prone to a denial-of-service vulnerability. An attacker may exploit this issue to cause denial-of-service conditions. The following versions of Junos on Juniper SRX5000 Series devices are vulnerable: Juniper Junos 12.3X48 versions prior to 12.3X48-D85 Juniper Junos...
Microsoft Edge CVE-2019-1356 Information Disclosure Vulnerability
Description Microsoft Edge is prone to an information disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Edge Recommendations Run all software as a nonprivileged user with minimal acce...
Microsoft Windows Secure Boot CVE-2019-1368 Local Security Bypass Vulnerability
Description Microsoft Windows is prone to a local security-bypass vulnerability. A local attacker can leverage this issue to bypass certain security restrictions and perform unauthorized actions. Technologies Affected Microsoft Windows 10 Version 1803 for 32-bit Systems Microsoft Windows 10 Versi...
Microsoft SQL Server Management Studio CVE-2019-1313 Information Disclosure Vulnerability
Description Microsoft SQL Server Management Studio is prone to an information-disclosure vulnerability. An attacker can leverage this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft SQL Server Management Studio 18.3 Microsoft SQL Server...
Microsoft SQL Server Management Studio CVE-2019-1376 Information Disclosure Vulnerability
Description Microsoft SQL Server Management Studio is prone to an information-disclosure vulnerability. An attacker can leverage this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft SQL Server Management Studio 18.3.1 Recommendations Block...
Apache Hadoop CVE-2018-11768 Memory Corruption Vulnerability
Description Apache Hadoop is prone to a memory-corruption vulnerability. A remote attacker may exploit this issue to crash the server resulting in a denial-of-service condition. Technologies Affected Apache Hadoop 2.0.0 Alpha Apache Hadoop 2.0.0-alpha Apache Hadoop 2.0.1 Alpha Apache Hadoop 2.0.2...
Cisco Unified Communications Manager CVE-2019-12710 SQL Injection Vulnerability
Description Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit...
Cisco Unified CM CVE-2019-12711 XML Entity Expansion Multiple Security Vulnerabilities
Description Cisco Unified Communications Manager is prone to multiple security vulnerabilities. An attacker can exploit these issues to gain access to sensitive information or cause denial-of-service conditions. These issues are being tracked by Cisco Bug ID CSCvp46079. Technologies Affected Cisc...
Palo Alto Networks Zingbox Inspector CVE-2019-15019 Security Bypass Vulnerability
Description Palo Alto Networks Zingbox Inspector is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Versions prior to Zingbox Inspector 1.295 are vulnerable...