Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result in an extended denial of service condition for the device. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S1; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.
[106541]
[https://kb.juniper.net/JSA10900]
On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs, the output of the command: show pfe filter hw summary will not show the entry for: RACL group Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2. This issue affect both IPv4 and IPv6 firewall filter.
[106669]
[https://kb.juniper.net/JSA10901]
[https://www.juniper.net/documentation/en_US/junos/topics/reference/command-summary/show-pfe-filter.html]
When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash with a core file being generated. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1 versions prior to 15.1R3; 15.1F versions prior to 15.1F3; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400.
[106544]
[https://kb.juniper.net/JSA10902]
On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS on EX and QFX series;: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R7; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 series; 15.1X53 versions prior to 15.1X53-D591 on EX2300/EX3400 series; 16.1 versions prior to 16.1R7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.
[106665]
[https://kb.juniper.net/JSA10905]
A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.
[106666]
[https://kb.juniper.net/JSA10906]
The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5 on vMX Series.
[106564]
[https://kb.juniper.net/JSA10903]
A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. Affected releases are Juniper Networks Junos OS on QFX 5000 series, EX4300, EX4600 are: 14.1X53; 15.1X53 versions prior to 15.1X53-D235; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2, 17.3R4; 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1, 18.1R4; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2.
[107897]
[https://kb.juniper.net/JSA10930]
On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE). In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members. This issue does not affect other Junos platforms. Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R2-S2, 18.1R3; 18.2 versions prior to 18.2R2.
[106548]
[https://kb.juniper.net/JSA10909]
An SRX Series Service Gateway configured for Unified Threat Management (UTM) may experience a system crash with the error message "mbuf exceed" -- an indication of memory buffer exhaustion -- due to the receipt of crafted HTTP traffic. Each crafted HTTP packet inspected by UTM consumes mbufs which can be identified through the following log messages: all_logs.0:Jun 8 03:25:03 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 50%. all_logs.0:Jun 8 03:25:13 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 51%. all_logs.0:Jun 8 03:25:24 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 52%. ... Eventually the system runs out of mbufs and the system crashes (fails over) with the error "mbuf exceed". This issue only occurs when HTTP AV inspection is configured. Devices configured for Web Filtering alone are unaffected by this issue. Affected releases are Junos OS on SRX Series: 12.1X46 versions prior to 12.1X46-D81; 12.3X48 versions prior to 12.3X48-D77; 15.1X49 versions prior to 15.1X49-D101, 15.1X49-D110.
[106535]
[https://kb.juniper.net/JSA10910]
The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kernel causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS: 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 17.2X75 versions prior to 17.2X75-D110; 18.1 versions prior to 18.1R2.
[106534]
[https://kb.juniper.net/JSA10911]
A Denial of Service (DoS) vulnerability in BGP in Juniper Networks Junos OS configured as a VPLS PE allows an attacker to craft a specific BGP message to cause the routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. This issue only affects PE routers configured with BGP Auto discovery for LDP VPLS. Other BGP configurations are unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81; 12.3 versions prior to 12.3R12-S12; 12.3X48 versions prior to 12.3X48-D76; 14.1X53 versions prior to 14.1X53-D48; 15.1 versions prior to 15.1F6-S12, 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D235, 15.1X53-D495, 15.1X53-D590, 15.1X53-D68; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R1-S5, 17.4R2; 18.1 versions prior to 18.1R2-S3, 18.1R3.
[106536]
[https://kb.juniper.net/JSA10912]
The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can result in an extended Denial of Service (DoS) condition. This issue only affects IPv4 PIM. IPv6 PIM is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77; 12.3X48 versions prior to 12.3X48-D77; 15.1 versions prior to 15.1F6-S10, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D233, 15.1X53-D59; 16.1 versions prior to 16.1R3-S8, 16.1R4-S8, 16.1R7; 16.2 versions prior to 16.2R2-S6; 17.1 versions prior to 17.1R2-S6, 17.1R3; 17.2 versions prior to 17.2R2-S3, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R2.
[106519]
[https://kb.juniper.net/JSA10913]
On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Service (DoS). This issue affects both IPv4 and IPv6 packet processing. Affected releases are Juniper Networks Junos OS on QFX and PTX Series: 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R1-S3, 18.2R2; 17.2X75 versions prior to 17.2X75-D91, 17.2X75-D100.
[106556]
[https://kb.juniper.net/JSA10914]
A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.
[106668]
[https://kb.juniper.net/JSA10915]
A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
[https://kb.juniper.net/JSA10917]
The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
[https://kb.juniper.net/JSA10917]
A persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9, 16.2R3; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3-S1; 17.3 versions prior to 17.3R3-S3, 17.3R3-S4, 17.3R4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4, 18.1R4; 18.2 versions prior to 18.2R2-S2, 18.2R2-S3, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. This issue does not affect Junos releases prior to 16.1R1.
[107893]
[https://kb.juniper.net/JSA10931]
Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.
[https://kb.juniper.net/JSA10918]
Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart. By simulating a specific BGP session restart, an attacker can repeatedly crash the RPD process causing prolonged denial of service (DoS). Graceful restart helper mode for BGP is enabled by default. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.2X75 versions prior to 17.2X75-D92, 17.2X75-D102, 17.2X75-D110; 17.3 versions prior to 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 18.1 versions prior to 18.1R2. Junos OS releases prior to 16.1R1 are not affected.
[107892]
[https://kb.juniper.net/JSA10932]
Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
[https://kb.juniper.net/JSA10918]
Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon configured to respond to IPv6 requests. Once started, memory consumption will eventually impact any IPv4 or IPv6 request serviced by the jdhcpd daemon, thus creating a Denial of Service (DoS) condition to clients requesting and not receiving IP addresses. Additionally, some clients which were previously holding IPv6 addresses will not have their IPv6 Identity Association (IA) address and network tables agreed upon by the jdhcpd daemon after the failover event occurs, which leads to more than one interface, and multiple IP addresses, being denied on the client. Affected releases are Juniper Networks Junos OS: 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.
[107874]
[https://kb.juniper.net/JSA10920]
A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper Networks Service Insight versions from 15.1R1, prior to 18.1R1. Service Now versions from 15.1R1, prior to 18.1R1.
[107885]
[https://kb.juniper.net/JSA10921]
[https://kb.juniper.net/KB27572]
A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service (DoS). This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D25 prior to 12.1X46-D71, 12.1X46-D73 on SRX Series; 12.3X48 versions prior to 12.3X48-D50 on SRX Series; 15.1X49 versions prior to 15.1X49-D75 on SRX Series.
[107882]
[https://kb.juniper.net/JSA10922]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a vulnerability. Notes: Google gRPC credentials were found which existed for specific internal product testing purposes which are not used as part of production releases of Junos OS. Hence this is not a vulnerability and this CVE ID assignment has been withdrawn.
When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on systems booted from an OAM (Operations, Administration, and Maintenance) volume, leading to a possible administrative bypass with physical access to the console. OAM volumes (e.g. flash drives) are typically instantiated as /dev/gpt/oam, or /oam for short. Password recovery, changing the root password from a console, should not have been allowed from an insecure console. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496, 15.1X53-D68; 16.1 versions prior to 16.1R3-S10, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2. This issue does not affect Junos OS releases prior to 15.1.
[https://kb.juniper.net/JSA10924]
When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1", "internal-2", etc.) are silently ignored. No warning is issued during configuration, and the config is committed without error, but the filter criteria will match all packets leading to unexpected results. Affected releases are Juniper Networks Junos OS: All versions prior to and including 12.3; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D161, 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496, 15.1X53-D69; 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4; 18.2 versions prior to 18.2R1-S5, 18.2R2-S1; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3; 18.4 versions prior to 18.4R1-S1, 18.4R1-S2.
[https://kb.juniper.net/JSA10925]
In a Dynamic Host Configuration Protocol version 6 (DHCPv6) environment, the jdhcpd daemon may crash and restart upon receipt of certain DHCPv6 solicit messages received from a DHCPv6 client. By continuously sending the same crafted packet, an attacker can repeatedly crash the jdhcpd process causing a sustained Denial of Service (DoS) to both IPv4 and IPv6 clients. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496; 16.1 versions prior to 16.1R3-S10, 16.1R7-S4; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S6, 17.4R2-S3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S2; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S2. This issue does not affect Junos OS releases prior to 15.1.
[107894]
[https://kb.juniper.net/JSA10926]
Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffer space exhaustion. This issue only affects the SRX340 and SRX345 services gateways. No other products or platforms are affected by this vulnerability. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D160 on SRX340/SRX345; 17.3 on SRX340/SRX345; 17.4 versions prior to 17.4R2-S3, 17.4R3 on SRX340/SRX345; 18.1 versions prior to 18.1R3-S1 on SRX340/SRX345; 18.2 versions prior to 18.2R2 on SRX340/SRX345; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX340/SRX345. This issue does not affect Junos OS releases prior to 15.1X49 on any platform.
[107873]
[https://kb.juniper.net/JSA10927]
If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.2 versions prior to 18.2R1-S5; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S1.
[107899]
[https://kb.juniper.net/JSA10928]
On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface (e.g. fxp0) thus disclosing internal addressing and existence of the management interface itself. A high rate of crafted packets destined to port 111 may also lead to a partial Denial of Service (DoS). Note: Systems with fxp0 disabled or unconfigured are not vulnerable to this issue. This issue only affects Junos OS releases based on FreeBSD 10 or higher (typically Junos OS 15.1+). Administrators can confirm whether systems are running a version of Junos OS based on FreeBSD 10 or higher by typing: user@junos> show version | match kernel JUNOS OS Kernel 64-bit [20181214.223829_fbsd-builder_stable_10] Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X53 versions prior to 15.1X53-D236; 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8; 17.3 versions prior to 17.3R2; 17.4 versions prior to 17.4R1-S1, 17.4R1-S7, 17.4R2. This issue does not affect Junos OS releases prior to 15.1.
[107902]
[https://kb.juniper.net/JSA10929]
On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices.
[https://kb.juniper.net/JSA10933]
Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of Service (DoS) condition for the network.
[https://kb.juniper.net/JSA10934]
In MPLS environments, receipt of a specific SNMP packet may cause the routing protocol daemon (RPD) process to crash and restart. By continuously sending a specially crafted SNMP packet, an attacker can repetitively crash the RPD process causing prolonged denial of service. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS : 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D48 on EX/QFX series; 15.1 versions prior to 15.1R4-S9, 15.1R7-S2; 15.1F6 versions prior to 15.1F6-S11; 15.1X49 versions prior to 15.1X49-D141, 15.1X49-D144, 15.1X49-D150 on SRX Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX Series; 15.1X53 versions prior to 15.1X53-D590 on EX2300/EX3400 Series; 15.1X54 on ACX Series; 16.1 versions prior to 16.1R3-S10, 16.1R4-S11, 16.1R6-S5, 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R2-S6; 17.1 versions prior to 17.1R2-S8, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.2X75 versions prior to 17.2X75-D92, 17.2X75-D102, 17.2X75-D110; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 18.1 versions prior to 18.1R1-S1, 18.1R2-S1, 18.1R3; 18.2X75 versions prior to 18.2X75-D10.
[https://kb.juniper.net/JSA10935]
Receipt of a specific packet on the out-of-band management interface fxp0 may cause the system to crash and restart (vmcore). By continuously sending a specially crafted packet to the fxp0 interface, an attacker can repetitively crash the rpd process causing prolonged Denial of Service (DoS). Affected releases are Juniper Networks SRX5000 Series: 12.1X46 versions prior to 12.1X46-D82; 12.3X48 versions prior to 12.3X48-D80; 15.1X49 versions prior to 15.1X49-D160.
[107872]
[https://kb.juniper.net/JSA10936]
A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A reboot of the device is required to restore service. Continued receipt of these valid broadcast packets will create a sustained Denial of Service (DoS) against the device. Affected releases are Juniper Networks Junos OS: 16.1 versions above and including 16.1R1 prior to 16.1R7-S5; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.
[109272]
[https://kb.juniper.net/JSA10938]
A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions on the Junos device. Successful exploitation requires a Junos administrator to first perform certain diagnostic actions on J-Web. This issue affects: Juniper Networks Junos OS 12.1X46 versions prior to 12.1X46-D86; 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D497, 15.1X53-D69; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R1-S7, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3; 18.4 versions prior to 18.4R1-S2, 18.4R2.
[https://kb.juniper.net/JSA10970]
On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority. This rule is meant for reserved multicast addresses 224.0.0.x, but incorrectly matches on 224.x.x.x. Due to this bug, when a firewall filter is applied on the loopback interface, other firewall filters might stop working for multicast traffic. The command 'show firewall filter' can be used to confirm whether the filter is working. This issue only affects the EX4300 switch. No other products or platforms are affected by this vulnerability. This issue affects: Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D51, 14.1X53-D115 on EX4300 Series; 17.1 versions prior to 17.1R3 on EX4300 Series; 17.2 versions prior to 17.2R3-S2 on EX4300 Series; 17.3 versions prior to 17.3R3-S3 on EX4300 Series; 17.4 versions prior to 17.4R2-S5, 17.4R3 on EX4300 Series; 18.1 versions prior to 18.1R3-S1 on EX4300 Series; 18.2 versions prior to 18.2R2 on EX4300 Series; 18.3 versions prior to 18.3R2 on EX4300 Series.
[https://kb.juniper.net/JSA10942]
On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a certain sequence of BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart. Repeated crashes of the RPD process can cause prolonged Denial of Service (DoS). Graceful restart helper mode for BGP is enabled by default. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S3; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.2X75 versions prior to 17.2X75-D105; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S7, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R3-S2; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D12, 18.2X75-D30; 18.3 versions prior to 18.3R1-S4, 18.3R2. Junos OS releases prior to 16.1R1 are not affected.
[https://kb.juniper.net/JSA10943]
Under certain heavy traffic conditions srxpfe process can crash and result in a denial of service condition for the SRX1500 device. Repeated crashes of the srxpfe can result in an extended denial of service condition. The SRX device may fail to forward traffic when this condition occurs. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D170 on SRX1500; 17.3 versions prior to 17.3R3-S7 on SRX1500; 17.4 versions prior to 17.4R2-S8, 17.4R3 on SRX1500; 18.1 versions prior to 18.1R3-S8 on SRX1500; 18.2 versions prior to 18.2R3 on SRX1500; 18.3 versions prior to 18.3R2 on SRX1500; 18.4 versions prior to 18.4R2 on SRX1500.
[https://kb.juniper.net/JSA10972]
SSL-Proxy feature on SRX devices fails to handle a hardware resource limitation which can be exploited by remote SSL/TLS servers to crash the flowd daemon. Repeated crashes of the flowd daemon can result in an extended denial of service condition. For this issue to occur, clients protected by the SRX device must initiate a connection to the malicious server. This issue affects: Juniper Networks Junos OS on SRX5000 Series: 12.3X48 versions prior to 12.3X48-D85; 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S6, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R2.
[https://kb.juniper.net/JSA10973]
The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a regular TCP packet which causes the processor to crash. This issue affects all SRX Series platforms that support URL-Filtering and have web-filtering enabled. Affected releases are Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 15.1X49 versions prior to 15.1X49-D181, 15.1X49-D190 on SRX Series; 17.3 versions on SRX Series; 17.4 versions prior to 17.4R1-S8, 17.4R2-S5, 17.4R3 on SRX Series; 18.1 versions prior to 18.1R3-S6 on SRX Series; 18.2 versions prior to 18.2R2-S1, 18.2R3 on SRX Series; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX Series; 18.4 versions prior to 18.4R1-S1, 18.4R2 on SRX Series.
[109145]
[https://kb.juniper.net/JSA10946]
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of environment variables when connecting via the telnet client to remote telnet servers. This issue only affects the telnet client ? accessible from the CLI or shell ? in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2.
[http://packetstormsecurity.com/files/153746/FreeBSD-Security-Advisory-FreeBSD-SA-19-12.telnet.html]
[https://kb.juniper.net/JSA10947]
[20190724 FreeBSD Security Advisory FreeBSD-SA-19:12.telnet]
[FreeBSD-SA-19:12]
[https://www.exploit-db.com/exploits/45982]
An Improper Certificate Validation weakness in the SRX Series Application Identification (app-id) signature update client of Juniper Networks Junos OS allows an attacker to perform Man-in-the-Middle (MitM) attacks which may compromise the integrity and confidentiality of the device. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D120 on SRX Series devices. No other versions of Junos OS are affected.
[https://kb.juniper.net/JSA10952]
[https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-application-identification-overview.html]
A vulnerability in the SIP ALG packet processing service of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific types of valid SIP traffic to the device. In this case, the flowd process crashes and generates a core dump while processing SIP ALG traffic. Continued receipt of these valid SIP packets will result in a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D61, 12.3X48-D65 on SRX Series; 15.1X49 versions prior to 15.1X49-D130 on SRX Series; 17.3 versions prior to 17.3R3 on SRX Series; 17.4 versions prior to 17.4R2 on SRX Series.
[https://kb.juniper.net/JSA10953]
[https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-sip-alg.html]
This issue only affects devices with three (3) or more MPC10's installed in a single chassis with OSPF enabled and configured on the device. An Insufficient Resource Pool weakness allows an attacker to cause the device's Open Shortest Path First (OSPF) states to transition to Down, resulting in a Denial of Service (DoS) attack. This attack requires a relatively large number of specific Internet Mixed (IMIXed) types of genuine and valid IPv6 packets to be transferred by the attacker in a relatively short period of time, across three or more PFE's on the device at the same time. Continued receipt of the traffic sent by the attacker will continue to cause OSPF to remain in the Down starting state, or flap between other states and then again to Down, causing a persistent Denial of Service. This attack will affect all IPv4, and IPv6 traffic served by the OSPF routes once the OSPF states transition to Down. This issue affects: Juniper Networks Junos OS on MX480, MX960, MX2008, MX2010, MX2020: 18.1 versions prior to 18.1R2-S4, 18.1R3-S5; 18.1X75 version 18.1X75-D10 and later versions; 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.2X75 versions prior to 18.2X75-D50; 18.3 versions prior to 18.3R1-S4, 18.3R2, 18.3R3; 18.4 versions prior to 18.4R1-S2, 18.4R2.
[https://kb.juniper.net/JSA10954]
An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager (JDM) application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1, 18.2X75-D5.
[https://kb.juniper.net/JSA10955]
A vulnerability in the Veriexec subsystem of Juniper Networks Junos OS allowing an attacker to fully compromise the host system. A local authenticated user can elevate privileges to gain full control of the system even if they are specifically denied access to perform certain actions. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D80 on SRX Series.
[https://kb.juniper.net/JSA10956]
A memory leak vulnerability in the of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific commands from a peered BGP host and having those BGP states delivered to the vulnerable device. This issue affects: Juniper Networks Junos OS: 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.1X75 all versions. Versions before 18.1R1 are not affected.
[https://kb.juniper.net/JSA10957]
The flowd process, responsible for forwarding traffic in SRX Series services gateways, may crash and restart when processing specific transit IP packets through an IPSec tunnel. Continued processing of these packets may result in an extended Denial of Service (DoS) condition. This issue only occurs when IPSec tunnels are configured. Systems without IPSec tunnel configurations are not vulnerable to this issue. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180 on SRX Series; 18.2 versions 18.2R2-S1 and later, prior to 18.2R3 on SRX Series; 18.4 versions prior to 18.4R2 on SRX Series.
[https://kb.juniper.net/JSA10959]
[https://www.juniper.net/documentation/en_US/junos/topics/topic-map/ipsec-tunnel-traffic-configuration.html]
The management daemon (MGD) is responsible for all configuration and management operations in Junos OS. The Junos CLI communicates with MGD over an internal unix-domain socket and is granted special permission to open this protected mode socket. Due to a misconfiguration of the internal socket, a local, authenticated user may be able to exploit this vulnerability to gain administrative privileges. This issue only affects Linux-based platforms. FreeBSD-based platforms are unaffected by this vulnerability. Exploitation of this vulnerability requires Junos shell access. This issue cannot be exploited from the Junos CLI. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D496, 15.1X53-D69; 16.1 versions prior to 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S6, 17.4R1-S7, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4; 18.2 versions prior to 18.2R1-S5, 18.2R2-S2, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2.
[https://kb.juniper.net/JSA10960]
A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web session and potentially gain administrative access to the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S15 on EX Series; 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S5; 15.1X49 versions prior to 15.1X49-D180 on SRX Series; 15.1X53 versions prior to 15.1X53-D238; 16.1 versions prior to 16.1R4-S13, 16.1R7-S5; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R2-S8, 17.2R3-S3; 17.3 versions prior to 17.3R3-S5; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S2, 19.1R2.
[https://kb.juniper.net/JSA10961]
When an MX Series Broadband Remote Access Server (BRAS) is configured as a Broadband Network Gateway (BNG) with DHCPv6 enabled, jdhcpd might crash when receiving a specific crafted DHCP response message on a subscriber interface. The daemon automatically restarts without intervention, but continuous receipt of specific crafted DHCP messages will repeatedly crash jdhcpd, leading to an extended Denial of Service (DoS) condition. This issue only affects systems configured with DHCPv6 enabled. DHCPv4 is unaffected by this issue. This issue affects Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S5 on MX Series; 16.1 versions prior to 16.1R7-S5 on MX Series; 16.2 versions prior to 16.2R2-S10 on MX Series; 17.1 versions prior to 17.1R3-S1 on MX Series; 17.2 versions prior to 17.2R3-S2 on MX Series; 17.3 versions prior to 17.3R3-S6 on MX Series; 17.4 versions prior to 17.4R2-S5, 17.4R3 on MX Series; 18.1 versions prior to 18.1R3-S6 on MX Series; 18.2 versions prior to 18.2R2-S4, 18.2R3 on MX Series; 18.2X75 versions prior to 18.2X75-D50 on MX Series; 18.3 versions prior to 18.3R1-S5, 18.3R3 on MX Series; 18.4 versions prior to 18.4R2 on MX Series; 19.1 versions prior to 19.1R1-S2, 19.1R2 on MX Series.
[https://kb.juniper.net/JSA10962]
On SRX5000 Series devices, if 'set security zones security-zone <zone> tcp-rst' is configured, the flowd process may crash when a specific TCP packet is received by the device and triggers a new session. The process restarts automatically. However, receipt of a constant stream of these TCP packets may result in an extended Denial of Service (DoS) condition on the device. This issue affects Juniper Networks Junos OS: 18.2R3 on SRX 5000 Series; 18.4R2 on SRX 5000 Series; 19.2R1 on SRX 5000 Series.
[https://kb.juniper.net/JSA10963]
On MX Series, when the SIP ALG is enabled, receipt of a certain malformed SIP packet may crash the MS-PIC component on MS-MIC or MS-MPC. By continuously sending a crafted SIP packet, an attacker can repeatedly bring down MS-PIC on MS-MIC/MS-MPC causing a sustained Denial of Service. This issue affects Juniper Networks Junos OS on MX Series: 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3-S3; 17.3 versions prior to 17.3R3-S6 ; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S3; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2.
[https://kb.juniper.net/JSA10964]
An unexpected status return value weakness in the Next-Generation Multicast VPN (NG-mVPN) service of Juniper Networks Junos OS allows attacker to cause a Denial of Service (DoS) condition and core the routing protocol daemon (rpd) process when a specific malformed IPv4 packet is received by the device running BGP. This malformed packet can be crafted and sent to a victim device including when forwarded directly through a device receiving such a malformed packet, but not if the malformed packet is first de-encapsulated from an encapsulated format by a receiving device. Continued receipt of the malformed packet will result in a sustained Denial of Service condition. This issue affects: Juniper Networks Junos OS 15.1 versions prior to 15.1F6-S12, 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D150 on SRX Series; 15.1X53 versions prior to 15.1X53-D68, 15.1X53-D235, 15.1X53-D495, 15.1X53-D590; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S2; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3.
[https://kb.juniper.net/JSA10965]
[https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/ng-mvpn-services-enabling.html]
Receipt of a specific link-local IPv6 packet destined to the RE may cause the system to crash and restart (vmcore). By continuously sending a specially crafted IPv6 packet, an attacker can repeatedly crash the system causing a prolonged Denial of Service (DoS). This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R6-S2, 16.1R7; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R3. This issue does not affect Juniper Networks Junos OS version 15.1 and prior versions.
[https://kb.juniper.net/JSA10966]
The SRX flowd process, responsible for packet forwarding, may crash and restart when processing specific multicast packets. By continuously sending the specific multicast packets, an attacker can repeatedly crash the flowd process causing a sustained Denial of Service. This issue affects Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D90; 15.1X49 versions prior to 15.1X49-D180; 17.3 versions; 17.4 versions prior to 17.4R2-S5, 17.4R3; 18.1 versions prior to 18.1R3-S6; 18.2 versions prior to 18.2R2-S4, 18.2R3; 18.3 versions prior to 18.3R2-S1, 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S1, 19.1R2.
[https://kb.juniper.net/JSA10968]
On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SRX1500, SRX4000 Series, vSRX, SRX1500, SRX4000, QFX5110, QFX5200, QFX10K Series, when the user uses console management port to authenticate, the credentials used during device authentication are written to a log file in clear text. This issue does not affect users that are logging-in using telnet, SSH or J-web to the management IP. This issue affects ACX, NFX, SRX, EX and QFX platforms with the Linux Host OS architecture, it does not affect other SRX and EX platforms that do not use the Linux Host OS architecture. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D110 on vSRX, SRX1500, SRX4000 Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5110, QFX5200 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 17.1 versions prior to 17.1R2-S8, 17.1R3, on QFX5110, QFX5200, QFX10K Series; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3 on QFX5110, QFX5200, QFX10K Series; 17.3 versions prior to 17.3R2 on vSRX, SRX1500, SRX4000, QFX5110, QFX5200, QFX10K Series; 14.1X53 versions prior to 14.1X53-D47 on ACX5000, EX4600, QFX5100 Series; 15.1 versions prior to 15.1R7 on ACX5000, EX4600, QFX5100 Series; 16.1R7 versions prior to 16.1R7 on ACX5000, EX4600, QFX5100 Series; 17.1 versions prior to 17.1R2-S10, 17.1R3 on ACX5000, EX4600, QFX5100 Series; 17.2 versions prior to 17.2R3 on ACX5000, EX4600, QFX5100 Series; 17.3 versions prior to 17.3R3 on ACX5000, EX4600, QFX5100 Series; 17.4 versions prior to 17.4R2 on ACX5000, EX4600, QFX5100 Series; 18.1 versions prior to 18.1R2 on ACX5000, EX4600, QFX5100 Series; 15.1X53 versions prior to 15.1X53-D496 on NFX Series, 17.2 versions prior to 17.2R3-S1 on NFX Series; 17.3 versions prior to 17.3R3-S4 on NFX Series; 17.4 versions prior to 17.4R2-S4, 17.4R3 on NFX Series, 18.1 versions prior to 18.1R3-S4 on NFX Series; 18.2 versions prior to 18.2R2-S3, 18.2R3 on NFX Series; 18.3 versions prior to 18.3R1-S3, 18.3R2 on NFX Series; 18.4 versions prior to 18.4R1-S1, 18.4R2 on NFX Series.
[https://kb.juniper.net/JSA10969]
An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions to take control of other portions of the NFX platform they should not be able to access, and execute commands outside their authorized scope of control. This leads to the attacker being able to take control of the entire system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1 on NFX Series.
[https://kb.juniper.net/JSA10977]
Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versions of Junos OS, affecting specific EX Series platforms, the Veriexec subsystem will fail to initialize, in essence disabling file integrity checking. This may allow a locally authenticated user with shell access to install untrusted executable images, and elevate privileges to gain full control of the system. During the installation of an affected version of Junos OS are installed, the following messages will be logged to the console: Initializing Verified Exec: /sbin/veriexec: Undefined symbol "__aeabi_uidiv" /sbin/veriexec: Undefined symbol "__aeabi_uidiv" /sbin/veriexec: Undefined symbol "__aeabi_uidiv" veriexec: /.mount/packages/db/os-kernel-prd-arm-32-20190221.70c2600_builder_stable_11/boot/brcm-hr3.dtb: Authentication error veriexec: /.mount/packages/db/os-kernel-prd-arm-32-20190221.70c2600_builder_stable_11/boot/contents.izo: Authentication error ... This issue affects Juniper Networks Junos OS: 18.1R3-S4 on EX2300, EX2300-C and EX3400; 18.3R1-S3 on EX2300, EX2300-C and EX3400.
[https://kb.juniper.net/JSA10978]
[https://www.juniper.net/documentation/en_US/junos/topics/concept/veriexec.html]
An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R13; 8.5.0 versions prior to 8.5.0R4.
[https://kb.juniper.net/JSA10971]
The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2.
[https://kb.juniper.net/JSA10974]
A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. This issue only affects NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series with Next-Generation Routing Engine (NG-RE) which uses vmhost. This issue affects Juniper Networks Junos OS on NFX150 Series and QFX10K, EX9200 Series, MX Series and PTX Series with NG-RE and vmhost: 15.1F versions prior to 15.1F6-S12 16.1 versions starting from 16.1R6 and later releases, including the Service Releases, prior to 16.1R6-S6, 16.1R7-S3; 17.1 versions prior to 17.1R3; 17.2 versions starting from 17.2R1-S3, 17.2R3 and later releases, including the Service Releases, prior to 17.2R3-S1; 17.3 versions starting from 17.3R1-S1, 17.3R2 and later releases, including the Service Releases, prior to 17.3R3-S3; 17.4 versions starting from 17.4R1 and later releases, including the Service Releases, prior to 17.4R1-S6, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2, 18.3R2; 18.4 versions prior to 18.4R1-S1, 18.4R2. This issue does not affect: Juniper Networks Junos OS 15.1 and 16.2.
[https://kb.juniper.net/JSA10975]
A vulnerability in the srxpfe process on Protocol Independent Multicast (PIM) enabled SRX series devices may lead to crash of the srxpfe process and an FPC reboot while processing (PIM) messages. Sustained receipt of these packets may lead to an extended denial of service condition. Affected releases are Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D80; 15.1X49 versions prior to 15.1X49-D160; 17.3 versions prior to 17.3R3-S7 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R2; 18.3 versions prior to 18.3R2.
[https://kb.juniper.net/JSA10976]
Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
[https://support.f5.com/csp/article/K35815741]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Insufficient path checking in Intel(R) System Support Utility for Windows before 2.5.0.15 may allow an authenticated user to potentially enable an escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00212.html]
Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-A_04.00.04.181.0, and SPS_SoC-X_04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access.
[https://support.f5.com/csp/article/K47234311]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Insufficient access control vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow unauthenticated user to potentially enable escalation of privilege via physical access.
[https://support.f5.com/csp/article/K59145983]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
[https://support.f5.com/csp/article/K21423526]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
[https://support.f5.com/csp/article/K84591451]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow a privileged user to potentially enable information disclosure via local access.
[https://support.f5.com/csp/article/K13710800]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable denial of service via adjacent network access.
[https://support.f5.com/csp/article/K84591451]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an authenticated user to potentially enable escalation of privilege via adjacent network access.
[https://support.f5.com/csp/article/K84591451]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially enable denial of service via network access.
[https://support.f5.com/csp/article/K84591451]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
[https://support.f5.com/csp/article/K10522033]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
[https://support.f5.com/csp/article/K30105730]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Authentication bypass in the Intel Unite(R) solution versions 3.2 through 3.3 may allow an unauthenticated user to potentially enable escalation of privilege to the Intel Unite(R) Solution administrative portal via network access.
[107076]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00214.html]
Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
[107069]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
[107074]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
[107109]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially enable escalation of privilege via local access.
[107069]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Insufficient run protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.
[107069]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Insufficient user prompt in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.
[107069]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of information via local access.
[107075]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Improper folder permissions in Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
[107069]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
[107071]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
[107067]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Improper flow control in crypto routines for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable a denial of service via local access.
[107064]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html]
Insufficient bounds checking in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.
[108385]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html]
A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.
[108385]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html]
Insufficient input validation in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable denial of service via local access.
[108385]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html]
An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow a privileged user to potentially enable denial of service via local access.
[108385]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html]
Buffer overflow vulnerability in system firmware for Intel(R) Xeon(R) Processor D Family, Intel(R) Xeon(R) Scalable Processor, Intel(R) Server Board, Intel(R) Server System and Intel(R) Compute Module may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
[108485]
[https://support.f5.com/csp/article/K85585101]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html]
Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) Processor N Series, Intel(R) Celeron(R) J Series, Intel(R) Celeron(R) N Series, Intel(R) Atom(R) Processor A Series, Intel(R) Atom(R) Processor E3900 Series, Intel(R) Pentium(R) Processor Silver Series may allow a privileged user to potentially enable denial of service via local access.
[108485]
[https://support.f5.com/csp/article/K29002929]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html]
Improper permissions in Intel(R) Matrix Storage Manager 8.9.0.1023 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
[http://support.lenovo.com/us/en/solutions/LEN-26976]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00216.html]
Double free in Intel(R) SGX SDK for Linux before version 2.2 and Intel(R) SGX SDK for Windows before version 2.1 may allow an authenticated user to potentially enable information disclosure or denial of service via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00217.html]
Insufficient access control in silicon reference firmware for Intel(R) Xeon(R) Scalable Processor, Intel(R) Xeon(R) Processor D Family may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
[108485]
[https://support.f5.com/csp/article/K37428370]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html]
Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable information disclosure via local access.
[107110]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00222.html]
Improper permissions in the installer for Intel(R) Chipset Device Software (INF Update Utility) before version 10.1.1.45 may allow an authenticated user to escalate privilege via local access.
[108767]
[https://support.lenovo.com/us/en/product_security/LEN-27840]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00224.html]
Improper permissions for Intel(R) USB 3.0 Creator Utility all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00229.html]
Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentially enable denial of service via network access.
[108775]
[https://support.lenovo.com/us/en/product_security/LEN-27843]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html]
Data Corruption in Intel Unite(R) Client before version 3.3.176.13 may allow an unauthenticated user to potentially cause a denial of service via network access.
[108388]
[https://support.lenovo.com/us/en/product_security/LEN-27709]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00228.html]
Improper permissions in the installer for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an authenticated user to potentially enable escalation of privilege via local access. L-SA-00206
[https://support.lenovo.com/us/en/product_security/LEN-27843]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00231.html]
Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
[JVN#75617741]
[108777]
[[debian-lts-announce] 20190914 [SECURITY] [DLA 1919-1] linux-4.9 security update]
[[debian-lts-announce] 20190915 [SECURITY] [DLA 1919-2] linux-4.9 security update]
[[debian-lts-announce] 20190925 [SECURITY] [DLA 1930-1] linux security update]
[https://support.lenovo.com/us/en/product_security/LEN-27828]
[USN-4115-1]
[USN-4118-1]
[USN-4145-1]
[USN-4147-1]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00232.html]
Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00234.html]
Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
[https://support.f5.com/csp/article/K71265658]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Insufficient input validation in the Intel(R) SGX driver for Linux may allow an authenticated user to potentially enable a denial of service via local access.
[108771]
[https://support.f5.com/csp/article/K10244523]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00235.html]
Insufficient path checking in the installation package for Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
[107888]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00236.html]
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.
[openSUSE-SU-2019:1172]
[RHSA-2019:2125]
[https://edk2-docs.gitbooks.io/security-advisory/content/partitiondxe-and-udf-buffer-overflow.html]
[FEDORA-2019-d47a9d4b8b]
Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.
[openSUSE-SU-2019:1352]
[openSUSE-SU-2019:1425]
[RHSA-2019:2125]
[RHSA-2019:2437]
[https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html]
[FEDORA-2019-d47a9d4b8b]
Memory access in virtual memory mapping for some microprocessors may allow an authenticated user to potentially enable information disclosure via local access.
[https://support.f5.com/csp/article/K26710120]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00238.html]
Insufficient input validation in system firmware for Intel(R) Broadwell U i5 vPro before version MYBDWi5v.86A may allow an authenticated user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00239.html]
Improper permissions in the installer for Intel(R) Turbo Boost Max Technology 3.0 driver version 1.0.0.1035 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
[108770]
[https://support.lenovo.com/us/en/product_security/LEN-27841]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00243.html]
Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access.
[https://support.f5.com/csp/article/K51470205]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html]
Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://support.f5.com/csp/article/K33245306]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00244.html]
A logic issue in Intel Unite(R) Client for Android prior to version 4.0 may allow a remote attacker to potentially enable escalation of privilege via network access.
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00245.html]
Authentication bypass in the web console for Intel(R) Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00246.html]
Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access.
[108731]
[https://security.netapp.com/advisory/ntap-20190612-0001/]
[https://support.f5.com/csp/article/K18165180]
[https://support.lenovo.com/us/en/product_security/LEN-27842]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00247.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/in]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file
[[CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks]
[http://packetstormsecurity.com/files/152642/Apache-Pluto-3.0.0-3.0.1-Cross-Site-Scripting.html]
[108091]
[[CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks]
[https://portals.apache.org/pluto/security.html]
[46759]
[[CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks]
Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.
[[jmeter-user] 20190302 [SECURITY] CVE-2019-0187: Apache JMeter Missing client auth for RMI connection when distributed test is used]
[107219]
Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
[JVN#71498764]
[[oss-security] 20190524 [SECURITY][ERRATA-CORRIGE] New security advisory CVE-2019-0188 released for Apache Camel]
[108422]
[https://github.com/apache/camel/blob/master/docs/user-manual/en/security-advisories/CVE-2019-0188.txt.asc]
[[camel-users] 20190524 [SECURITY][ERRATA-CORRIGE] New security advisory CVE-2019-0188 released for Apache Camel]
[[tamaya-dev] 20190607 [jira] [Created] (TAMAYA-410) Update camel-core dependency past CVE-2019-0188]
[[tamaya-commits] 20190607 [incubator-tamaya-sandbox] branch master updated: TAMAYA-410 bump camel-core version past CVE-2019-0188]
[[tamaya-commits] 20190607 [GitHub] [incubator-tamaya-sandbox] peculater merged pull request #30: TAMAYA-410 bump camel-core version past CVE-2019-0188]
[[tamaya-commits] 20190607 [GitHub] [incubator-tamaya-sandbox] ottlinger commented on issue #30: TAMAYA-410 bump camel-core version past CVE-2019-0188]
[[tamaya-commits] 20190607 [GitHub] [incubator-tamaya-sandbox] peculater opened a new pull request #30: TAMAYA-410 bump camel-core version past CVE-2019-0188]
[[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.]
[[tamaya-dev] 20190607 [jira] [Commented] (TAMAYA-410) Update camel-core dependency past CVE-2019-0188]
[[tamaya-dev] 20190607 [jira] [Closed] (TAMAYA-410) Update camel-core dependency past CVE-2019-0188]
The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16
[[ofbiz-notifications] 20190913 [jira] [Updated] (OFBIZ-10837) Improve ObjectInputStream class (CVE-2019-0189)]
[[ofbiz-notifications] 20190913 [jira] [Updated] (OFBIZ-10770) Update Apache commons-fileupload to last version (CVE-2019-0189)]
[[ofbiz-dev] 20190910 [CVE-2019-0189] Apache OFBiz remote code execution and arbitrary file delete via Java]
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.
[106743]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[GLSA-201903-21]
[https://security.netapp.com/advisory/ntap-20190125-0001/]
[https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.
[107462]
[[karaf-user] 20190307 [SECURITY] New security advisory for CVE-2019-0191 released for Apache Karaf]
[[karaf-commits] 20190506 [karaf-site] branch trunk updated: Publish CVE-2019-0226]
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
[[www-announce] 20190307 CVE-2019-0192 Deserialization of untrusted data via jmx.serviceUrl in Apache Solr]
[107318]
[RHSA-2019:2413]
[[lucene-dev] 20190320 [jira] [Issue Comment Deleted] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl]
[[lucene-dev] 20190327 [jira] [Commented] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl]
[[lucene-dev] 20190320 [jira] [Commented] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl]
[[lucene-dev] 20190326 [jira] [Updated] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl]
[[lucene-dev] 20190326 [jira] [Commented] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl]
[https://security.netapp.com/advisory/ntap-20190327-0003/]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
[https://issues.apache.org/jira/browse/SOLR-13669]
[[debian-lts-announce] 20191010 [SECURITY] [DLA 1954-1] lucene-solr security update]
Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
[[oss-security] 20190430 [SECURITY] New security advisory CVE-2019-0194 released for Apache Camel]
[108181]
[[camel-users] 20190430 [SECURITY] New security advisory CVE-2019-0194 released for Apache Camel]
[[camel-commits] 20190524 [camel] branch master updated: Added security advisory for CVE-2019-0188]
[[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html]
[[camel-commits] 20190430 [camel] branch master updated: Added CVE-2019-0194 details]
[[camel-commits] 20190524 [camel] 02/02: CVE-2019-0188 - Changed the title in security advisories]
[https://lists.apache.org/thread.html/a39441db574ee996f829344491b3211b53c9ed926f00ae5d88943b76@%3Cdev.camel.apache.org%3E]
[[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html]
Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.
[[tapestry-users] 20190913 [CVE-2019-0195] Apache Tapestry vulnerability disclosure]
[[tapestry-users] 20191014 Re: [CVE-2019-0195] Apache Tapestry vulnerability disclosure]
[[tapestry-users] 20191007 Re: [CVE-2019-0195] Apache Tapestry vulnerability disclosure]
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.
[openSUSE-SU-2019:1190]
[openSUSE-SU-2019:1209]
[openSUSE-SU-2019:1258]
[http://www.apache.org/dist/httpd/CHANGES_2.4.39]
[[oss-security] 20190401 CVE-2019-0196: mod_http2, read-after-free on a string compare]
[107669]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190611 svn commit: r1046148 - in /websites/production/httpd/content: ./ mail]
[[httpd-cvs] 20190611 svn commit: r1861068 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml]
[FEDORA-2019-cf7695b470]
[FEDORA-2019-c7187e6dc7]
[FEDORA-2019-08e57d15fd]
[20190403 [SECURITY] [DSA 4422-1] apache2 security update]
[https://security.netapp.com/advisory/ntap-20190617-0002/]
[https://support.f5.com/csp/article/K44591505]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us]
[USN-3937-1]
[DSA-4422]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
[openSUSE-SU-2019:1190]
[openSUSE-SU-2019:1209]
[openSUSE-SU-2019:1258]
[[oss-security] 20190401 CVE-2019-0197: mod_http2, possible crash on late upgrade]
[107665]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808@%3Cdev.httpd.apache.org%3E]
[FEDORA-2019-cf7695b470]
[https://security.netapp.com/advisory/ntap-20190617-0002/]
[https://support.f5.com/csp/article/K44591505]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us]
[USN-4113-1]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none.
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
[openSUSE-SU-2019:1673]
[openSUSE-SU-2019:1723]
[openSUSE-SU-2019:1808]
[107674]
[[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml]
[[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E]
[[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199]
[[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS]
[FEDORA-2019-d66febb5df]
[FEDORA-2019-1a3f878d27]
[https://security.netapp.com/advisory/ntap-20190419-0001/]
[https://support.f5.com/csp/article/K17321505]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
[107215]
[[qpid-users] 20190301 [SECURITY] CVE-2019-0200: Apache Qpid Broker-J Denial of Service due to malformed AMQP 0-8 to 0-10 commands]
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL() command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
[108427]
[https://issues.apache.org/jira/browse/ZOOKEEPER-1392]
[[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar]
[[accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201)]
[[bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5]
[[debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security update]
[20190612 [SECURITY] [DSA 4461-1] zookeeper security update]
[https://security.netapp.com/advisory/ntap-20190619-0001/]
[DSA-4461]
[https://zookeeper.apache.org/security.html#CVE-2019-0201]
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.
[[storm-user] 20190724 [CVE-2019-0202] Apache Storm Logviewer file system access vulnerability]
In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.
[http://subversion.apache.org/security/CVE-2019-0203-advisory.txt]
A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host.
[107605]
[[mesos-dev] 20190323 CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible.]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.
[[tapestry-users] 20190913 CVE-2019-0207: Apache Tapestry vulnerability disclosure]
[[tapestry-users] 20191007 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
[openSUSE-SU-2019:1190]
[openSUSE-SU-2019:1209]
[openSUSE-SU-2019:1258]
[http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html]
[http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html]
[http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html]
[http://www.apache.org/dist/httpd/CHANGES_2.4.39]
[[oss-security] 20190401 CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts]
[[oss-security] 20190726 Re: Statistics for distros lists updated for 2019Q2]
[107666]
[RHBA-2019:0959]
[RHSA-2019:0746]
[RHSA-2019:0980]
[RHSA-2019:1296]
[RHSA-2019:1297]
[RHSA-2019:1543]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[community-dev] 20190411 CVE-2019-0211 applicable to versions 2.2.x?]
[[httpd-users] 20190406 [users@httpd] CVE-2019-0211/0215/0217]
[[community-dev] 20190411 Re: CVE-2019-0211 applicable to versions 2.2.x?]
[[community-dev] 20190411 RE: CVE-2019-0211 applicable to versions 2.2.x?]
[[httpd-cvs] 20190611 svn commit: r1861068 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml]
[FEDORA-2019-a4ed7400f4]
[FEDORA-2019-119b14075a]
[FEDORA-2019-cf7695b470]
[20190407 [slackware-security] httpd (SSA:2019-096-01)]
[20190403 [SECURITY] [DSA 4422-1] apache2 security update]
[GLSA-201904-20]
[https://security.netapp.com/advisory/ntap-20190423-0001/]
[https://support.f5.com/csp/article/K32957101]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us]
[USN-3937-1]
[DSA-4422]
[46676]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
[https://www.synology.com/security/advisory/Synology_SA_19_14]
In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.
[[oss-security] 20190327 [CVE-2019-0212] Apache HBase REST Server incorrect user authorization]
[107624]
[https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E]
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva server must be compromised.
[http://archiva.apache.org/security.html#CVE-2019-0213]
[http://packetstormsecurity.com/files/152681/Apache-Archiva-2.2.3-Cross-Site-Scripting.html]
[[oss-security] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS]
[108123]
[[archiva-users] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS]
[[announce] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS]
[[archiva-issues] 20190501 [jira] [Created] (MRM-1987) Port security fixes for 2.2.4 to 3.0.0]
[[maven-users] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS]
[20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS]
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
[http://archiva.apache.org/security.html#CVE-2019-0214]
[http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html]
[[oss-security] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server]
[108124]
[[announce] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server]
[[maven-users] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server]
[[archiva-users] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server]
[[archiva-issues] 20190501 [jira] [Created] (MRM-1987) Port security fixes for 2.2.4 to 3.0.0]
[20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server]
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.
[[oss-security] 20190401 CVE-2019-0215: mod_ssl access control bypass]
[107667]
[RHSA-2019:0980]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-dev] 20190804 Re: svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t]
[[httpd-cvs] 20190402 svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-dev] 20190806 Re: svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190806 svn commit: r1864463 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t]
[FEDORA-2019-a4ed7400f4]
[FEDORA-2019-119b14075a]
[FEDORA-2019-cf7695b470]
[https://security.netapp.com/advisory/ntap-20190423-0001/]
[https://support.f5.com/csp/article/K59440504]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
[[oss-security] 20190410 CVE-2019-0216, CVE-2019-0229 vulnerabilities affecting Apache Airflow <= 1.10.2 webserver component]
[107869]
[https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231@%3Cdev.airflow.apache.org%3E]
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
[openSUSE-SU-2019:1190]
[openSUSE-SU-2019:1209]
[openSUSE-SU-2019:1258]
[[oss-security] 20190401 CVE-2019-0217: mod_auth_digest access control bypass]
[107668]
[RHSA-2019:2343]
[https://bugzilla.redhat.com/show_bug.cgi?id=1695020]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-dev] 20190402 re: svn commit: r33393 - /release/httpd/CHANGES_2.4]
[[debian-lts-announce] 20190403 [SECURITY] [DLA 1748-1] apache2 security update]
[FEDORA-2019-a4ed7400f4]
[FEDORA-2019-119b14075a]
[EDORA-2019-cf7695b470]
[20190403 [SECURITY] [DSA 4422-1] apache2 security update]
[https://security.netapp.com/advisory/ntap-20190423-0001/]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us]
[USN-3937-1]
[USN-3937-2]
[DSA-4422]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.
[108046]
[[ponymail-users] 20190420 [CVE-2019-0218] Apache Pony Mail (incubating) Reflected XSS]
[[oss-security] 20190420 [CVE-2019-0218] Apache Pony Mail (incubating) Reflected XSS]
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.
[openSUSE-SU-2019:1190]
[openSUSE-SU-2019:1209]
[openSUSE-SU-2019:1258]
[[oss-security] 20190401 CVE-2019-0220: URL normalization inconsistincies]
[107670]
[RHSA-2019:2343]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[debian-lts-announce] 20190403 [SECURITY] [DLA 1748-1] apache2 security update]
[FEDORA-2019-a4ed7400f4]
[FEDORA-2019-119b14075a]
[FEDORA-2019-cf7695b470]
[20190403 [SECURITY] [DSA 4422-1] apache2 security update]
[https://security.netapp.com/advisory/ntap-20190625-0007/]
[https://support.f5.com/csp/article/K44591505]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us]
[USN-3937-1]
[DSA-4422]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
[openSUSE-SU-2019:1673]
[openSUSE-SU-2019:1808]
[20190529 XSS in SSI printenv command - Apache Tomcat - CVE-2019-0221]
[108545]
[https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c@%3Cannounce.tomcat.apache.org%3E]
[[debian-lts-announce] 20190530 [SECURITY] [DLA 1810-1] tomcat7 security update]
[[debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update]
[FEDORA-2019-d66febb5df]
[FEDORA-2019-1a3f878d27]
[https://security.netapp.com/advisory/ntap-20190606-0001/]
[https://support.f5.com/csp/article/K13184144?utm_source=f5support&utm_medium=RSS]
[USN-4128-1]
[USN-4128-2]
[https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/]
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
[http://activemq.apache.org/security-advisories.data/CVE-2019-0222-announcement.txt]
[[oss-security] 20190327 [ANNOUNCE] CVE-2019-0222 - Apache ActiveMQ: Corrupt MQTT frame can cause broker shutdown]
[107622]
[[activemq-dev] 20190328 Re: Website]
[[activemq-commits] 20190327 [CONF] Apache ActiveMQ > Security Advisories]
[[activemq-dev] 20190327 CVE-2019-0222 - Apache ActiveMQ: Corrupt MQTT frame can cause broker shutdown]
[[activemq-users] 20190327 CVE-2019-0222 - Apache ActiveMQ: Corrupt MQTT frame can cause broker shutdown]
[[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/]
[[activemq-commits] 20190327 svn commit: r1042603 - /websites/production/activemq/content/security-advisories.data/CVE-2019-0222-announcement.txt]
[[activemq-dev] 20190327 Re: Website]
[https://security.netapp.com/advisory/ntap-20190502-0006/]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
[[oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability]
[108044]
[RHSA-2019:0886]
[RHSA-2019:1398]
[RHSA-2019:1399]
[RHSA-2019:1400]
[RHSA-2019:2777]
[RHSA-2019:2778]
[RHSA-2019:2779]
[RHSA-2019:2780]
[RHSA-2019:2781]
[RHSA-2019:2782]
[https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel]
[[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability]
[[qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability]
[[qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability]
[qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223]
[[announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability]
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.
[107631]
[https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0224]
[[jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures]
[[jspwiki-dev] 20190326 [CVE-2019-0224] Apache JSPWiki Cross-site scripting vulnerability]
[[jspwiki-commits] 20190329 [jspwiki-site] branch jbake updated: add CVE-2019-0224 and CVE-2019-0225 vulnerability disclosures]
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
[[oss-security] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure]
[107627]
[https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0225]
[[announce] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure]
[[jspwiki-user] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure]
[[jspwiki-dev] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure]
[[jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures]
[[jspwiki-commits] 20190329 [jspwiki-site] branch jbake updated: add CVE-2019-0224 and CVE-2019-0225 vulnerability disclosures]
Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. User should upgrade to Apache Karaf 4.2.5 or later.
[[karaf-dev] 20190506 [SECURITY] New security advisory for CVE-2019-0226 released for Apache Karaf]
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
[https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/]
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
[https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79@%3Cusers.pdfbox.apache.org%3E]
[[tika-commits] 20190802 svn commit: r1864252 [1/17] - in /tika/site: publish/ publish/1.10/ publish/1.11/ publish/1.12/ publish/1.13/ publish/1.14/ publish/1.15/ publish/1.16/ publish/1.17/ publish/1.18/ publish/1.19.1/ publish/1.19/ publish/1.20/ publish/1.21/ publish/1.22/ ...]
[[james-server-dev] 20190708 [jira] [Created] (JAMES-2819) Upgrade pdfbox following CVE-2019-0228]
[[tika-commits] 20190802 svn commit: r1864251 [1/17] - in /tika/site: publish/ publish/1.10/ publish/1.11/ publish/1.12/ publish/1.13/ publish/1.14/ publish/1.15/ publish/1.16/ publish/1.17/ publish/1.18/ publish/1.19.1/ publish/1.19/ publish/1.20/ publish/1.21/ publish/1.22/ ...]
[FEDORA-2019-6fa01d12b4]
[FEDORA-2019-9e91afa2be]
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
[[oss-security] 20190410 CVE-2019-0216, CVE-2019-0229 vulnerabilities affecting Apache Airflow <= 1.10.2 webserver component]
[107869]
[https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231@%3Cdev.airflow.apache.org%3E]
Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.
[http://mina.apache.org/mina-project/index.html#mina-211-mina-2021-released-posted-on-april-14-2019]
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
[http://packetstormsecurity.com/files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html]
[20190504 RCE in CGI Servlet - Apache Tomcat on Windows - CVE-2019-0232]
[107906]
[RHSA-2019:1712]
[https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/]
[https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html]
[[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[ofbiz-commits] 20190415 svn commit: r1857588 - in /ofbiz: ofbiz-framework/branches/release17.12/build.gradle ofbiz-plugins/branches/release17.12/example/build.gradle]
[[tomcat-users] 20190410 [SECURITY] CVE-2019-0232 Apache Tomcat Remote Code Execution on Windows]
[[ofbiz-commits] 20190415 svn commit: r1857587 - in /ofbiz: ofbiz-framework/branches/release18.12/build.gradle ofbiz-plugins/branches/release18.12/example/build.gradle]
[[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[ofbiz-notifications] 20190415 [jira] [Closed] (OFBIZ-10920) Update Tomcat to 9.0.18 due to CVE-2019-0232]
[[ofbiz-commits] 20190415 svn commit: r1857586 - in /ofbiz: ofbiz-framework/trunk/build.gradle ofbiz-plugins/trunk/example/build.gradle]
[[ofbiz-notifications] 20190415 [jira] [Commented] (OFBIZ-10920) Update Tomcat to 9.0.18 due to CVE-2019-0232]
[[tomcat-dev] 20190421 svn commit: r1857901 - in /tomcat/site/trunk: docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml]
[https://security.netapp.com/advisory/ntap-20190419-0001/]
[https://tools.cisco.com/security/center/viewAlert.x?alertId=60004&vs_f=Alert%20RSS&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Apache%20Tomcat%20CGI%20Servlet%20Arbitrary%20Code%20Execution%20Vulnerability&vs_k=1]
[https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/]
[https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-784]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
[https://www.synology.com/security/advisory/Synology_SA_19_17]
[https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/]
A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of Roller, which is now Roller 5.2.3.
[https://lists.apache.org/thread.html/26cdef3fa8a8fa7fcbb99320aa860836ead124b414c654a4d12674cf@%3Cdev.roller.apache.org%3E]
SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[106462]
[https://launchpad.support.sap.com/#/notes/2697573]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legitimate users from accessing the application by crashing it.
[106470]
[https://launchpad.support.sap.com/#/notes/2724059]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
[106461]
[https://launchpad.support.sap.com/#/notes/2725538]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
[106467]
[https://launchpad.support.sap.com/#/notes/2727623]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[106473]
[https://launchpad.support.sap.com/#/notes/2588763]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[106468]
[https://launchpad.support.sap.com/#/notes/2588763]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.
[106463]
[https://launchpad.support.sap.com/#/notes/2696233]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
[https://launchpad.support.sap.com/#/notes/2696233]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted.
[106471]
[https://launchpad.support.sap.com/#/notes/2723142]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.
[106464]
[https://launchpad.support.sap.com/#/notes/2727624]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985]
The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[106993]
[https://launchpad.support.sap.com/#/notes/2638175]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[107004]
[https://launchpad.support.sap.com/#/notes/2706798]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly. That behavior may lead to situation, where business user achieves access to the full SAP Menu, that is 'Easy Access Menu'. The situation can be misused by any user to leverage privileges to business functionality.
[106987]
[https://launchpad.support.sap.com/#/notes/2723570]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted.
[106995]
[https://launchpad.support.sap.com/#/notes/2723878]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
[106999]
[https://launchpad.support.sap.com/#/notes/2728839]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
[106969]
[https://launchpad.support.sap.com/#/notes/2724014]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.
[106997]
[https://launchpad.support.sap.com/#/notes/2727564]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).
[106986]
[https://launchpad.support.sap.com/#/notes/2742027]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting (XSS) vulnerability.
[106998]
[https://launchpad.support.sap.com/#/notes/2696714]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.
[106972]
[107364]
[https://launchpad.support.sap.com/#/notes/2729710]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Even though this trace file is protected from unauthorized access, the risk of leaking information is increased.
[106988]
[https://launchpad.support.sap.com/#/notes/2724713]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application.
[106990]
[https://launchpad.support.sap.com/#/notes/2686535]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943]
SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source.
[107364]
[https://launchpad.support.sap.com/#/notes/2689259]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080]
SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[107359]
[https://launchpad.support.sap.com/#/notes/2693962]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080]
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.
[107377]
[https://launchpad.support.sap.com/#/notes/2727689]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080]
ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability. Fixed in Kernel 7.21 or 7.22, that is ABAP Server 7.00 to 7.31 and Kernel 7.45, 7.49 or 7.53, that is ABAP Server 7.40 to 7.52 or ABAP Platform.
[107355]
[https://launchpad.support.sap.com/#/notes/2736825]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080]
SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service (i.e. denial of service). Fixed in versions 3.1 SP03 PL02, SDK 3.1 SP04, or later.
[107360]
[https://launchpad.support.sap.com/#/notes/2753497]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080]
SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode user-controlled inputs, which results in cross-site scripting (XSS) vulnerability.
[107362]
[https://launchpad.support.sap.com/#/notes/2689925]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080]
Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges.
[107353]
[https://launchpad.support.sap.com/#/notes/2754235]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080]
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).
[107356]
[https://launchpad.support.sap.com/#/notes/2764283]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080]
Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure.
[https://launchpad.support.sap.com/#/notes/2741201]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114]
ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.
[https://launchpad.support.sap.com/#/notes/2753629]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114]
SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.
[https://launchpad.support.sap.com/#/notes/2744937]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032]
SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[109077]
[https://launchpad.support.sap.com/#/notes/2756539]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker.
[https://launchpad.support.sap.com/#/notes/2742758]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114]
SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document.
[https://launchpad.support.sap.com/#/notes/2747683]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114]
SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.
[https://launchpad.support.sap.com/#/notes/2772376]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114]
The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.
[http://packetstormsecurity.com/files/153471/SAP-Crystal-Reports-Information-Disclosure.html]
[https://launchpad.support.sap.com/#/notes/2687663]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114]
Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.
[108316]
[https://launchpad.support.sap.com/#/notes/2737278]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032]
Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.
[https://launchpad.support.sap.com/#/notes/2738796]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032]
Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.
[108313]
[https://launchpad.support.sap.com/#/notes/2748699]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032]
Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740).
[108324]
[https://launchpad.support.sap.com/#/notes/2756625]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032]
SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54.
[108314]
[https://launchpad.support.sap.com/#/notes/2773086]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032]
Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing.
[https://launchpad.support.sap.com/#/notes/2784307]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032]
SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript code when the url is accessed.
[https://launchpad.support.sap.com/#/notes/2637997]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.
[https://launchpad.support.sap.com/#/notes/2719530]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data.
[https://launchpad.support.sap.com/#/notes/2755502]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete list of SAP HANA user IDs and names.
[https://launchpad.support.sap.com/#/notes/2771128]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained.
[https://launchpad.support.sap.com/#/notes/2772266]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.
[https://launchpad.support.sap.com/#/notes/2773493]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability.
[https://launchpad.support.sap.com/#/notes/2728153]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information like host names, ports or other technical data in the absence of restrictive firewall and port settings.
[https://launchpad.support.sap.com/#/notes/2744086]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
[https://launchpad.support.sap.com/#/notes/2793805]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 and SAP_XIPCK 7.10 to 7.11, 7.20, 7.30) allows an attacker to access passwords used in FTP channels leading to information disclosure.
[https://launchpad.support.sap.com/#/notes/2755438]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim?s browser, by injecting malicious scripts in certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in reflected Cross Site Scripting vulnerability.
[https://launchpad.support.sap.com/#/notes/2745917]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242]
Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted.
[109069]
[https://launchpad.support.sap.com/#/notes/2738791]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.
[http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html]
[109074]
[https://cxsecurity.com/ascii/WLB-2019050283]
[https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f]
[https://launchpad.support.sap.com/#/notes/2752614]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[109078]
[https://launchpad.support.sap.com/#/notes/2773888]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
[109076]
[https://launchpad.support.sap.com/#/notes/2781873]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.
[109075]
[https://launchpad.support.sap.com/#/notes/2798133]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[109072]
[https://launchpad.support.sap.com/#/notes/2764733]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.
[109071]
[https://launchpad.support.sap.com/#/notes/2777910]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system.
[109067]
[https://launchpad.support.sap.com/#/notes/2774489]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[109070]
[https://launchpad.support.sap.com/#/notes/2804833]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
[109068]
[https://launchpad.support.sap.com/#/notes/2808158]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575]
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure.
[https://launchpad.support.sap.com/#/notes/2742468]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability.
[https://launchpad.support.sap.com/#/notes/2742468]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.
[https://launchpad.support.sap.com/#/notes/2764513]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting.
[https://launchpad.support.sap.com/#/notes/2771221]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the description field in the list, when generating the little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack.
[https://launchpad.support.sap.com/#/notes/2742468]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability
[https://launchpad.support.sap.com/#/notes/2789866]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure.
[https://launchpad.support.sap.com/#/notes/2793351]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.
[https://launchpad.support.sap.com/#/notes/2794742]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.
[https://launchpad.support.sap.com/#/notes/2794742]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.
[https://launchpad.support.sap.com/#/notes/2786035]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
[https://launchpad.support.sap.com/#/notes/2786035]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.
[https://launchpad.support.sap.com/#/notes/2813811]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.
[https://launchpad.support.sap.com/#/notes/2764513]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.
[https://launchpad.support.sap.com/#/notes/2751470]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute ?Go to statement? without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check
[https://launchpad.support.sap.com/#/notes/2798743]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this, an attacker can exploit Services Registry potentially enabling them to take complete control of the product, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate.
[https://launchpad.support.sap.com/#/notes/2800779]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017]
In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.
[https://launchpad.support.sap.com/#/notes/2735924]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would otherwise be restricted.
[https://launchpad.support.sap.com/#/notes/2768864]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.
[https://launchpad.support.sap.com/#/notes/2798336]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench ? MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.
[https://launchpad.support.sap.com/#/notes/2802521]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges.
[https://launchpad.support.sap.com/#/notes/2829681]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
[https://launchpad.support.sap.com/#/notes/2820607]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload the server or retrieve information about internal network ports.
[https://launchpad.support.sap.com/#/notes/2817491]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports.
[https://launchpad.support.sap.com/#/notes/2817491]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
[https://launchpad.support.sap.com/#/notes/2786151]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506]
SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.
[https://launchpad.support.sap.com/#/notes/2805777]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not sufficiently encode user-controlled inputs within the mail client resulting in Cross-Site Scripting vulnerability.
[https://launchpad.support.sap.com/#/notes/2751806]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by uploading files containing malicious scripts, leading to reflected cross site scripting vulnerability.
[https://launchpad.support.sap.com/#/notes/2806403]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.
[https://launchpad.support.sap.com/#/notes/2806403]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting
[https://launchpad.support.sap.com/#/notes/2817945]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting.
[https://launchpad.support.sap.com/#/notes/2817945]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.
[https://launchpad.support.sap.com/#/notes/2817945]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.
[https://launchpad.support.sap.com/#/notes/2817945]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.
[https://launchpad.support.sap.com/#/notes/2817945]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle (BC), leading to Missing Authentication Check
[https://launchpad.support.sap.com/#/notes/2826015]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters? default values to be part of the application logs leading to Information Disclosure.
[https://launchpad.support.sap.com/#/notes/2828682]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified by the user.
[https://launchpad.support.sap.com/#/notes/2792430]
[https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0549, CVE-2019-0554, CVE-2019-0569.
[106406]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0536]
An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.
[106390]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0537]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
[106419]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0538]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0567, CVE-2019-0568.
[106401]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0539]
[46203]
[46204]
[46485]
A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.
[106863]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0540]
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
[106402]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541]
[46536]
A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.
[106434]
[RHBA-2019:0959]
[RHSA-2019:1422]
[RHSA-2019:2551]
[RHSA-2019:2552]
[https://github.com/xtermjs/xterm.js/releases]
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
[106408]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0543]
[46156]
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
[106405]
[RHSA-2019:0040]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0545]
A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio.
[106391]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0546]
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka "Windows DHCP Client Remote Code Execution Vulnerability." This affects Windows 10, Windows 10 Servers.
[106394]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0547]
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.
[106410]
[RHSA-2019:0040]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0548]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0536, CVE-2019-0554, CVE-2019-0569.
[106409]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0549]
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019. This CVE ID is unique from CVE-2019-0551.
[106385]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0550]
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0550.
[106386]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0551]
An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
[106407]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0552]
[46162]
An information disclosure vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory, aka "Windows Subsystem for Linux Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.
[106412]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0553]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0536, CVE-2019-0549, CVE-2019-0569.
[106411]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0554]
An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Microsoft XmlDocument Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
[106395]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0555]
[46185]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2019-0557, CVE-2019-0558.
[106387]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0556]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2019-0556, CVE-2019-0558.
[106388]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0557]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint, Microsoft Business Productivity Servers. This CVE ID is unique from CVE-2019-0556, CVE-2019-0557.
[106389]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0558]
An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook.
[106397]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0559]
An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office.
[106398]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0560]
An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly, aka "Microsoft Word Information Disclosure Vulnerability." This affects Microsoft Word, Office 365 ProPlus, Microsoft Office, Word.
[106399]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0561]
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint.
[106400]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0562]
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.
[106413]
[RHSA-2019:0040]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0564]
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge.
[106416]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0565]
An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This affects Microsoft Edge.
[106417]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0566]
[46161]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0568.
[106418]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0567]
[46203]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0567.
[106420]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0568]
[46205]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0536, CVE-2019-0549, CVE-2019-0554.
[106414]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0569]
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
[106415]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0570]
[46184]
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0572, CVE-2019-0573, CVE-2019-0574.
[106426]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0571]
[46159]
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0573, CVE-2019-0574.
[106428]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0572]
[46157]
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0572, CVE-2019-0574.
[106430]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0573]
[46158]
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0572, CVE-2019-0573.
[106431]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0574]
[46160]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
[106404]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0575]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
[106422]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0576]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
[106423]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0577]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
[106424]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0578]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
[106425]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0579]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
[106429]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0580]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
[106432]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0581]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0583, CVE-2019-0584.
[106433]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0582]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0584.
[106435]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0583]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583.
[106436]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0584]
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft SharePoint, Microsoft Office Online Server, Microsoft Word, Microsoft SharePoint Server.
[106392]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0585]
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.
[106421]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0586]
An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server.
[106437]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106934]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0590]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106935]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0591]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0611.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0592]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106936]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0593]
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0604.
[106866]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0594]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599, CVE-2019-0625.
[106921]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10289]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0595]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599, CVE-2019-0625.
[106922]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0596]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0598, CVE-2019-0599, CVE-2019-0625.
[106923]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0597]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0599, CVE-2019-0625.
[106924]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0598]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0625.
[106925]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0599]
An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HID Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0601.
[106868]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0600]
An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HID Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0600.
[106883]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0601]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0615, CVE-2019-0616, CVE-2019-0619, CVE-2019-0660, CVE-2019-0664.
[106858]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0602]
A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. To exploit the vulnerability, an attacker could create a specially crafted request, causing Windows to execute arbitrary code with elevated permissions. The security update addresses the vulnerability by correcting how Windows Deployment Services TFTP Server handles objects in memory, aka 'Windows Deployment Services TFTP Server Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0603]
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
[106914]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106905]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0605]
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.
[106859]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0606]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106907]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0607]
A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1357.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0608]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0609]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106908]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0610]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0592.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0611]
A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0612]
A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework and Visual Studio Remote Code Execution Vulnerability'.
[106872]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0613]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0774.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0614]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0616, CVE-2019-0619, CVE-2019-0660, CVE-2019-0664.
[106860]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0615]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0619, CVE-2019-0660, CVE-2019-0664.
[106867]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0616]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0617]
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0662.
[106878]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0618]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0660, CVE-2019-0664.
[106864]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0619]
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0709, CVE-2019-0722.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0620]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0661, CVE-2019-0663.
[106873]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0621]
An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android Elevation of Privilege Vulnerability." This affects Skype 8.35.
[106465]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0622]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
[106891]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0623]
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
[106663]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0624]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599.
[106926]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0625]
A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.
[106887]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0626]
A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0631, CVE-2019-0632.
[106857]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0627]
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.
[106893]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0628]
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka 'Windows SMB Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0633.
[106876]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0630]
A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0627, CVE-2019-0632.
[106875]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0631]
A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0627, CVE-2019-0631.
[106880]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0632]
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka 'Windows SMB Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0630.
[106916]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0633]
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0645, CVE-2019-0650.
[106899]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0634]
An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
[106884]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0635]
An information vulnerability exists when Windows improperly discloses file information, aka 'Windows Information Disclosure Vulnerability'.
[106895]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0636]
A security feature bypass vulnerability exists when Windows Defender Firewall incorrectly applies firewall profiles to cellular network connections, aka 'Windows Defender Firewall Security Feature Bypass Vulnerability'.
[106879]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0637]
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0639]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106910]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0640]
A security feature bypass vulnerability exists in Microsoft Edge handles whitelisting, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.
[106871]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0641]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106911]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0642]
An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge Information Disclosure Vulnerability'.
[106874]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0643]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
[106889]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0644]
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0634, CVE-2019-0650.
[106896]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0645]
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
[106651]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0646]
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.
[106650]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0647]
An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data.To exploit the vulnerability, an attacker must know the memory address of where the object was created.The update addresses the vulnerability by changing the way certain functions handle objects in memory, aka Scripting Engine Information Disclosure Vulnerability. This CVE ID is unique from CVE-2019-0658.
[106885]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0648]
A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileged Vulnerability'.
[106877]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0649]
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0634, CVE-2019-0645.
[106901]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0650]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0652, CVE-2019-0655.
[106902]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0651]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0655.
[106903]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0652]
A spoofing vulnerability exists when Microsoft browsers improperly handles specific redirects, aka 'Microsoft Browser Spoofing Vulnerability'.
[106881]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0654]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652.
[106912]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0655]
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.
[106898]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0656]
A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.
[106890]
[RHSA-2019:0349]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657]
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0648.
[106882]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0658]
An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'.
[106892]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0659]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0619, CVE-2019-0664.
[106869]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0660]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0621, CVE-2019-0663.
[106870]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0661]
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0618.
[106888]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0662]
An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated attacker could run a specially crafted application, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0621, CVE-2019-0661.
[107098]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0663]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0619, CVE-2019-0660.
[106862]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0664]
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0666, CVE-2019-0667, CVE-2019-0772.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0665]
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0667, CVE-2019-0772.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0666]
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0666, CVE-2019-0772.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0667]
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.
[106894]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0668]
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
[106897]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0669]
A spoofing vulnerability exists in Microsoft SharePoint when the application does not properly parse HTTP content, aka 'Microsoft SharePoint Spoofing Vulnerability'.
[106900]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0670]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0672, CVE-2019-0673, CVE-2019-0674, CVE-2019-0675.
[106928]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0671]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0673, CVE-2019-0674, CVE-2019-0675.
[106929]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0672]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0672, CVE-2019-0674, CVE-2019-0675.
[106930]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0673]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0672, CVE-2019-0673, CVE-2019-0675.
[106931]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0674]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0672, CVE-2019-0673, CVE-2019-0674.
[106932]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0675]
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.
[106886]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676]
An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability, aka 'Microsoft Edge Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0678]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0680]
An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0689, CVE-2019-0692, CVE-2019-0693, CVE-2019-0694.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0682]
An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0683]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0803, CVE-2019-0859.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0685]
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.
[106937]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0686]
An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP Information Disclosure Vulnerability'.
[107685]
[https://arxiv.org/pdf/1906.10478.pdf]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0688]
An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0692, CVE-2019-0693, CVE-2019-0694.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0689]
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0695, CVE-2019-0701.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0690]
An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0689, CVE-2019-0693, CVE-2019-0694.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0692]
An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0689, CVE-2019-0692, CVE-2019-0694.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0693]
An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0689, CVE-2019-0692, CVE-2019-0693.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0694]
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0690, CVE-2019-0701.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0695]
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0696]
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0698, CVE-2019-0726.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0697]
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0697, CVE-2019-0726.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0698]
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0690, CVE-2019-0695.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0701]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0755, CVE-2019-0767, CVE-2019-0775, CVE-2019-0782.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0702]
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704, CVE-2019-0821.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0703]
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0703, CVE-2019-0821.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0704]
An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level, aka 'Windows NDIS Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0707]
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
[http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html]
[http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html]
[http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html]
[http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en]
[http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en]
[https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf]
[https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf]
[https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf]
[https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf]
[https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf]
[https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708]
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0620, CVE-2019-0722.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0709]
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0711, CVE-2019-0713.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0710]
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0710, CVE-2019-0713.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0711]
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0710, CVE-2019-0711.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0713]
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0715, CVE-2019-0717, CVE-2019-0718, CVE-2019-0723.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0714]
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0714, CVE-2019-0717, CVE-2019-0718, CVE-2019-0723.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0715]
A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0716]
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0714, CVE-2019-0715, CVE-2019-0718, CVE-2019-0723.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0717]
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0714, CVE-2019-0715, CVE-2019-0717, CVE-2019-0723.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0718]
A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0720]
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0620, CVE-2019-0709.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0722]
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0714, CVE-2019-0715, CVE-2019-0717, CVE-2019-0718.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0723]
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0686.
[106906]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0724]
A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0725]
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0697, CVE-2019-0698.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0726]
An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Diagnostic Hub Standard Collector, Visual Studio Standard Collector Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0727]
A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.
[20190430 OpenPGP and S/MIME signature forgery attacks in multiple email clients]
[[oss-security] 20190430 Spoofing OpenPGP and S/MIME Signatures in Emails (multiple clients)]
[106913]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0728]
An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'.
[106966]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0729]
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.
[http://packetstormsecurity.com/files/152533/Microsoft-Windows-LUAFV-Delayed-Virtualization-MAXIMUM_ACCESS-DesiredAccess-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0730]
[46713]
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.
[http://packetstormsecurity.com/files/152534/Microsoft-Windows-LUAFV-Delayed-Virtualization-Cross-Process-Handle-Duplication-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0731]
[46714]
A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Security Feature Bypass Vulnerability'.
[http://packetstormsecurity.com/files/152536/Microsoft-Windows-LUAFV-NtSetCachedSigningLevel-Device-Guard-Bypass.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0732]
[46716]
A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0733]
An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully decode and replace authentication request using Kerberos, allowing an attacker to be validated as an Administrator.The update addresses this vulnerability by changing how these requests are validated., aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0936.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0734]
An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory, aka 'Windows CSRSS Elevation of Privilege Vulnerability'.
[http://packetstormsecurity.com/files/152532/Microsoft-Windows-CSRSS-SxSSrv-Cached-Manifest-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0735]
[46712]
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0736]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0752, CVE-2019-0753, CVE-2019-0862.
[107708]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0739]
An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'.
[106971]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0741]
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0743.
[106967]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0742]
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0742.
[106970]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0743]
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0746]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0748]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
[http://packetstormsecurity.com/files/153078/Microsoft-Internet-Explorer-Windows-10-1809-17763.316-Memory-Corruption.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0752]
[https://www.zerodayinitiative.com/advisories/ZDI-19-359/]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0752, CVE-2019-0862.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0753]
A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0754]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0767, CVE-2019-0775, CVE-2019-0782.
[http://packetstormsecurity.com/files/153407/Microsoft-Windows-CmpAddRemoveContainerToCLFSLog-Arbitrary-File-Directory-Creation.html]
[http://packetstormsecurity.com/files/153408/Microsoft-Windows-Font-Cache-Service-Insecure-Sections.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0755]
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0756]
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.
[RHSA-2019:1259]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0757]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0882, CVE-2019-0961.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0758]
An information disclosure vulnerability exists when the Windows Print Spooler does not properly handle objects in memory, aka 'Windows Print Spooler Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0759]
A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of requests for specific URLs, aka 'Internet Explorer Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0768.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0761]
A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft Browsers Security Feature Bypass Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0762]
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0763]
A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerability'.
[107731]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0764]
A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0765]
An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Windows Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0766]
An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated attacker could run a specially crafted application, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0755, CVE-2019-0775, CVE-2019-0782.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0767]
A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, and to allow requests that should otherwise be ignored, aka 'Internet Explorer Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0761.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0768]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0769]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0770]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0773, CVE-2019-0783.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0771]
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0666, CVE-2019-0667.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0772]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0783.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0773]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0614.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0774]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0755, CVE-2019-0767, CVE-2019-0782.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0775]
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0776]
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0777]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0778]
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0779]
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0780]
An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0755, CVE-2019-0767, CVE-2019-0775.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0782]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0783]
A remote code execution vulnerability exists in the way that the ActiveX Data objects (ADO) handles objects in memory, aka 'Windows ActiveX Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0784]
A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failover server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0785]
An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials attempts to open a specially crafted file over the SMB protocol on the same machine, aka 'SMB Server Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0786]
A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0788, CVE-2019-1290, CVE-2019-1291.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0787]
A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0787, CVE-2019-1290, CVE-2019-1291.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0788]
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795.
[107702]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0790]
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795.
[107726]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0791]
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0793, CVE-2019-0795.
[107728]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0792]
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0792, CVE-2019-0795.
[107729]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0793]
A remote code execution vulnerability exists when OLE automation improperly handles objects in memory, aka 'OLE Automation Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0794]
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0792, CVE-2019-0793.
[107732]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0795]
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.
[http://packetstormsecurity.com/files/152535/Microsoft-Windows-LUAFV-LuafvCopyShortName-Arbitrary-Short-Name-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0796]
[46715]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0797]
A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0798]
A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted URL file that points to an Excel or PowerPoint file that was also downloaded.The update addresses the vulnerability by correcting how Office handles these files., aka 'Office Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0801]
[https://www.zerodayinitiative.com/advisories/ZDI-19-358/]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0849.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0802]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0859.
[http://packetstormsecurity.com/files/153034/Microsoft-Windows-Win32k-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803]
An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.
[RHSA-2019:1527]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804]
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0836, CVE-2019-0841.
[http://packetstormsecurity.com/files/152537/Microsoft-Windows-LUAFV-Delayed-Virtualization-Cache-Manager-Poisoning-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0805]
[46717]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0806]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0808]
A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library (DLL) files, aka 'Visual Studio Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0809]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0810]
[https://www.zerodayinitiative.com/advisories/ZDI-19-361/]
A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0811]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0812]
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain situations, aka 'Windows Admin Center Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0813]
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0848.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0814]
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
[107701]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0815]
A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816]
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0858.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0817]
An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces metadata permissions, aka 'Microsoft SQL Server Analysis Services Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0819]
A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
[RHSA-2019:1259]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0820]
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0703, CVE-2019-0704.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0821]
A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0822]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0824, CVE-2019-0825, CVE-2019-0826, CVE-2019-0827.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0823]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823, CVE-2019-0825, CVE-2019-0826, CVE-2019-0827.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0824]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823, CVE-2019-0824, CVE-2019-0826, CVE-2019-0827.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0825]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823, CVE-2019-0824, CVE-2019-0825, CVE-2019-0827.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0826]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823, CVE-2019-0824, CVE-2019-0825, CVE-2019-0826.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0827]
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0828]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0860, CVE-2019-0861.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0829]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0831.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0830]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0830.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0831]
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information Disclosure Vulnerability'.
[107704]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0833]
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory, aka 'Microsoft Scripting Engine Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0835]
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0841.
[http://packetstormsecurity.com/files/152538/Microsoft-Windows-LUAFV-PostLuafvPostReadWrite-SECTION_OBJECT_POINTERS-Race-Condition.html]
[107719]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0836]
[46718]
An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0837]
An information disclosure vulnerability exists when Windows Task Scheduler improperly discloses credentials to Windows Credential Manager, aka 'Windows Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0839.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0838]
An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'Windows Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0838.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0839]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0844.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0840]
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.
[http://packetstormsecurity.com/files/152463/Microsoft-Windows-AppX-Deployment-Service-Privilege-Escalation.html]
[http://packetstormsecurity.com/files/153009/Internet-Explorer-JavaScript-Privilege-Escalation.html]
[http://packetstormsecurity.com/files/153114/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html]
[http://packetstormsecurity.com/files/153215/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html]
[http://packetstormsecurity.com/files/153642/AppXSvc-Hard-Link-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0841]
[46683]
[https://www.zerodayinitiative.com/advisories/ZDI-19-360/]
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.
[107725]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0842]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0840.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0844]
A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0845]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0847, CVE-2019-0851, CVE-2019-0877, CVE-2019-0879.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0846]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0851, CVE-2019-0877, CVE-2019-0879.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0847]
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0814.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0848]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0802.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0849]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0877, CVE-2019-0879.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0851]
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0853]
[https://www.zerodayinitiative.com/advisories/ZDI-19-362/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-363/]
A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0856]
A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Spoofing Vulnerability'.
[107760]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0857]
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0858]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0861.
[107722]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0860]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860.
[107724]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0861]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0752, CVE-2019-0753.
[107727]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0862]
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
[http://packetstormsecurity.com/files/153008/Angry-Polar-Bear-2-Microsoft-Windows-Error-Reporting-Local-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0863]
A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka '.NET Framework Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0864]
A denial of service vulnerability exists when SymCrypt improperly handles a specially crafted digital signature.An attacker could exploit the vulnerability by creating a specially crafted connection or message.The security update addresses the vulnerability by correcting the way SymCrypt handles digital signatures., aka 'SymCrypt Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0865]
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.
[107749]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866]
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.
[107752]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0867]
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0870, CVE-2019-0871.
[107753]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0868]
A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.
[107768]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0869]
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0868, CVE-2019-0871.
[107754]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0870]
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0868, CVE-2019-0870.
[107755]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0871]
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0979.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0872]
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.
[107759]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0874]
An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOps Server Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0875]
An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information Disclosure Vulnerability'.
[107743]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0876]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0851, CVE-2019-0879.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0877]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0851, CVE-2019-0877.
[107741]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0879]
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0880]
An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege Vulnerability'.
[http://packetstormsecurity.com/files/152988/Microsoft-Windows-CmKeyBodyRemapToVirtualForEnum-Arbitrary-Key-Enumeration.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0881]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0758, CVE-2019-0961.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0882]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0911, CVE-2019-0918.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0884]
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0885]
An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0886]
A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard redirection, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
[108964]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0887]
[https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/]
[https://research.checkpoint.com/reverse-rdp-the-hyper-v-connection/]
A remote code execution vulnerability exists in the way that ActiveX Data Objects (ADO) handle objects in memory, aka 'ActiveX Data Objects (ADO) Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0888]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0889]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0890]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0891]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0892]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0893]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0894]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0895]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0896]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0897]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0898]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0899]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0901, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0900]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0902.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0901]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0902]
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0903]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0905, CVE-2019-0906, CVE-2019-0907, CVE-2019-0908, CVE-2019-0909, CVE-2019-0974.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0904]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0906, CVE-2019-0907, CVE-2019-0908, CVE-2019-0909, CVE-2019-0974.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0905]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0907, CVE-2019-0908, CVE-2019-0909, CVE-2019-0974.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0906]
[https://www.zerodayinitiative.com/advisories/ZDI-19-624/]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0906, CVE-2019-0908, CVE-2019-0909, CVE-2019-0974.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0907]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0906, CVE-2019-0907, CVE-2019-0909, CVE-2019-0974.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0908]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0906, CVE-2019-0907, CVE-2019-0908, CVE-2019-0974.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0909]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0884, CVE-2019-0918.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0911]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0912]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0913]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0914]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0915]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0916]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0917]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0884, CVE-2019-0911.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0918]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0988, CVE-2019-1005, CVE-2019-1055, CVE-2019-1080.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0920]
[https://www.zerodayinitiative.com/advisories/ZDI-19-625/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-626/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-627/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-638/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-639/]
An spoofing vulnerability exists when Internet Explorer improperly handles URLs, aka 'Internet Explorer Spoofing Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0921]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0922]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0923]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0924]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0925]
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0926]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0933, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0927]
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0928]
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0929]
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory, aka 'Internet Explorer Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0930]
An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0931]
An information disclosure vulnerability exists in Skype for Android, aka 'Skype for Android Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0932]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0937.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0933]
An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0734.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0936]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0937]
An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka 'Microsoft Edge Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0938]
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0940]
A denial of service exists in Microsoft IIS Server when the optional request filtering feature improperly handles requests, aka 'Microsoft IIS Server Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0941]
An elevation of privilege vulnerability exists in the Unified Write Filter (UWF) feature for Windows 10 when it improperly restricts access to the registry, aka 'Unified Write Filter Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0942]
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system, aka 'Windows ALPC Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0943]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0946, CVE-2019-0947.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0945]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0945, CVE-2019-0947.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0946]
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0945, CVE-2019-0946.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0947]
An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity, aka 'Windows Event Viewer Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0948]
[https://www.zerodayinitiative.com/advisories/ZDI-19-641/]
A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0950, CVE-2019-0951.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0949]
A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0949, CVE-2019-0951.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0950]
A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0949, CVE-2019-0950.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0951]
A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0952]
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0953]
An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Server Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0956]
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0958.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0957]
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0957.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0958]
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0984.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0959]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1014, CVE-2019-1017.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0960]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0758, CVE-2019-0882.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0961]
An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure Automation Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0962]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0963]
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0965]
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0966]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0968]
An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server, aka 'Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0971]
This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an authenticated attacker sends a specially crafted authentication request, aka 'Local Security Authority Subsystem Service Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0972]
An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Installer Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0973]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0906, CVE-2019-0907, CVE-2019-0908, CVE-2019-0909.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0974]
A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP addresses. To exploit this vulnerability, an attacker would have to convince a victim ADFS administrator to update the list of banned IP addresses. This security update corrects how ADFS updates its list of banned IP addresses., aka 'ADFS Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-1126.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0975]
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka 'NuGet Package Manager Tampering Vulnerability'.
[108210]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0977]
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0872.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0979]
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.
[RHSA-2019:1259]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980]
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.
[RHSA-2019:1259]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981]
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0982]
An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0998.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0983]
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0959.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0984]
A remote code execution vulnerability exists when the Microsoft Speech API (SAPI) improperly handles text-to-speech (TTS) input, aka 'Microsoft Speech API Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0985]
An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0986]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0920, CVE-2019-1005, CVE-2019-1055, CVE-2019-1080.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0988]
[https://www.zerodayinitiative.com/advisories/ZDI-19-723/]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0989]
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1023.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0990]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0991]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0992]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0993]
A security feature bypass vulnerability exists when urlmon.dll improperly handles certain Mark of the Web queries, aka 'Internet Explorer Security Feature Bypass Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0995]
A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery, aka 'Azure DevOps Server Spoofing Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0996]
An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0983.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0998]
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0999]
An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows an attacker to execute two PowerShell cmdlets in context of a privileged account, and perform privileged actions.To exploit this, an attacker would need to authenticate to the AzureÂ? AD Connect server, aka 'Microsoft Azure AD Connect Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1000]
TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role assignment and can lead to shared password leakage.
[https://github.com/nilsteampassnet/TeamPass/issues/2495]
Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2.
[https://github.com/go-gitea/gitea/pull/5631]
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be logged in to WordPress as an admin, and click a link. This vulnerability appears to have been fixed in 3.3.0 and later.
[https://advisories.dxw.com/advisories/csrf-mapsvg-lite/]
[https://wpvulndb.com/vulnerabilities/9198]
yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting (XSS) vulnerability in sidebar and table data that can result in Database fields aren't properly sanitized and allow code injection (Cross-Site Scripting). This attack appears to be exploitable via the payload needs to be stored in the database and the victim must see the db value in question.
[https://github.com/yugandhargangu/JspMyAdmin2/issues/22]
mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim server and trigger generation of pdf file with content <img src="phar://path/to/crafted/image">. This vulnerability appears to have been fixed in 7.1.8.
[https://github.com/mpdf/mpdf/issues/949]
RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity.
[https://github.com/RIOT-OS/RIOT/issues/10739]
aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3.
[https://github.com/horazont/aioxmpp/pull/268]
All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.
[https://helm.sh/blog/helm-security-notice-2019/index.html]
Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HTTP API to save charts that can result in a specially crafted chart could be uploaded and saved outside the intended location. This attack appears to be exploitable via A POST request to the HTTP API can save a chart archive outside of the intended directory. If authentication is, optionally, enabled this requires an authorized user to do so. This vulnerability appears to have been fixed in 0.8.1.
[https://helm.sh/blog/chartmuseum-security-notice-2019/index.html]
phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4.
[https://github.com/phpipam/phpipam/commit/fd37bd8fb2b9c306079db505e0e3fe79a096c31c]
[https://github.com/phpipam/phpipam/issues/2327]
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
[https://github.com/api-platform/core/issues/2364]
[https://github.com/api-platform/core/pull/2441]
Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.
[https://github.com/hexpm/hex/pull/646]
[https://github.com/hexpm/hex/pull/651]
Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.
[https://github.com/hexpm/hex_core/pull/48]
[https://github.com/hexpm/hex_core/pull/51]
Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.
[https://github.com/erlang/rebar3/pull/1986]
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
[https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03]
FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.
[https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e24986650014d67f484f3ffceef3f]
Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticket_id=[ticket number]. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
[https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03]
[https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-34-2019-01-14-Moderate-risk-moderate-impact-XSS-and-unauthorized-access]
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
[https://esnet-security.github.io/vulnerabilities/20190115_rssh]
[[debian-lts-announce] 20190130 [SECURITY] [DLA 1650-1] rssh security update]
[USN-3946-1]
[DSA-4377]
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
[openSUSE-SU-2019:1196]
[RHSA-2019:2298]
[https://github.com/libarchive/libarchive/pull/1120]
[https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1]
[[debian-lts-announce] 20190207 [SECURITY] [DLA 1668-1] libarchive security update]
[FEDORA-2019-c595a93536]
[FEDORA-2019-0233ec0ff3]
[USN-3884-1]
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.
[openSUSE-SU-2019:1196]
[RHSA-2019:2298]
[https://github.com/libarchive/libarchive/pull/1120]
[https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423]
[[debian-lts-announce] 20190207 [SECURITY] [DLA 1668-1] libarchive security update]
[FEDORA-2019-c595a93536]
[FEDORA-2019-0233ec0ff3]
[USN-3884-1]
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
[https://lab.louiz.org/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85ab4d316416]
[FEDORA-2019-f40c49b99e]
[FEDORA-2019-5a947d8603]
[https://xmpp.org/extensions/xep-0223.html#howitworks]
Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket handshake endpoint that can result in CSRF attack, possible leak of anti-CSRF token. This attack appears to be exploitable via malicious request against WebSocket handshake endpoint. This vulnerability appears to have been fixed in 1.14.0 and later.
[https://github.com/ptaoussanis/sente/issues/137]
OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) version v3.6-2 and earlier versions contains a SQL Injection vulnerability in Identified vulnerable parameters: id, id_access_type and id_attr_access that can result in a malicious attacker can include own SQL commands which database will execute. This attack appears to be exploitable via network connectivity.
[https://inf0seq.github.io/cve/2019/01/20/SQL-Injection-in-OPTOSS-Next-Gen-Network-Management-System-(NG-NetMS).html]
[https://sourceforge.net/projects/ngnms/]
[https://www.owasp.org/index.php/SQL_Injection]
OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting (XSS) vulnerability in /js/libs/jstree/demo/filebrowser/index.php page. The "id" and "operation" GET parameters can be used to inject arbitrary JavaScript which is returned in the page's response that can result in Cross-site scripting.This attack appear to be exploitable via network connectivity.
[https://inf0seq.github.io/cve/2019/01/20/Cross-site-scripting-(XSS)-in-OPTOSS-Next-Gen-Network-Management-System-(NG-NetMS).html]
[https://sourceforge.net/projects/ngnms/]
[https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-7580. Reason: This candidate is a reservation duplicate of CVE-2019-7580. Notes: All CVE users should reference CVE-2019-7580 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation link but not following the redirect will leave behind a PDF file on disk which will never be deleted by the plug-in.
[http://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html]
[20190326 [article2pdf (Wordpress plug-in)] Multiple vulnerabilities (CVE-2019-1000031, CVE-2019-1010257)]
[https://wpvulndb.com/vulnerabilities/9246]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-1010259. Reason: This candidate is a reservation duplicate of CVE-2019-1010259. Notes: All CVE users should reference CVE-2019-1010259 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-7575, CVE-2019-7577. Reason: This candidate is a reservation duplicate of CVE-2019-7575 and/or CVE-2019-7577. Notes: All CVE users should reference CVE-2019-7575 and/or CVE-2019-7577 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-7469. Reason: This candidate is a reservation duplicate of CVE-2013-7469. Notes: All CVE users should reference CVE-2013-7469 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-7469. Reason: This candidate is a reservation duplicate of CVE-2013-7469. Notes: All CVE users should reference CVE-2013-7469 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-8363. Reason: This candidate is a reservation duplicate of CVE-2019-8363. Notes: All CVE users should reference CVE-2019-8363 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
[46659]
[https://www.manageengine.com/products/service-desk/readme.html]
A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \..\..\ technique, arbitrary files can be loaded in the server response outside the root directory.
[http://packetstormsecurity.com/files/152244/Titan-FTP-Server-2019-Build-3505-Directory-Traversal.html]
[20190326 CVE-2019-10009 Titan FTP Server Version 2019 Build 3505 Directory Traversal/Local File Inclusion]
[http://www.southrivertech.com/software/regsoft/titanftp/v19/verhist_en.html]
[https://seclists.org/fulldisclosure/2019/Mar/47]
[46611]
[46611]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1004, CVE-2019-1056, CVE-2019-1059.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1001]
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.
[https://github.com/thephpleague/commonmark/issues/353]
[https://github.com/thephpleague/commonmark/releases/tag/0.18.3]
ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234.
[https://medium.com/@mdavis332/higher-ed-erp-portal-vulnerability-create-your-own-accounts-d865bd22cdd8]
Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager (for .NET) plugin before 2.1.4 in the moxiemanager directory within the installation folder ICS\ICS.NET\ICSFileServer.
[https://medium.com/@mdavis332/critical-vulnerability-in-higher-ed-erp-55580f8880c]
[https://www.sjoerdlangkemper.nl/2016/09/15/uploading-webshells-with-moxiemanager/]
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.
[https://blog.csdn.net/yalecaltech/article/details/88594388]
baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file.
[https://github.com/baigoStudio/baigoSSO/issues/12]
GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.
[https://ctrsec.io/index.php/2019/03/24/gforge-advanced-server-xss-commonsearch-php/]
CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
[http://dev.cmsmadesimple.org/bug/view/12001]
[https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/]
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41276]
[USN-4042-1]
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc for nStripes.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41275]
[USN-4042-1]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1002]
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Bresenham parameters.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274]
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274]
[USN-4042-1]
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.
[107290]
[RHSA-2019:1851]
[https://github.com/kubernetes/kubernetes/issues/74534]
[https://groups.google.com/forum/#!topic/kubernetes-announce/vmUUNkYfG9g]
[https://security.netapp.com/advisory/ntap-20190416-0002/]
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.
[[oss-security] 20190620 [ANNOUNCE] Incomplete fixes for CVE-2019-1002101, kubectl cp potential directory traversal - CVE-2019-11246]
[[oss-security] 20190805 Kubernetes v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249]
[107652]
[RHBA-2019:0619]
[RHBA-2019:0620]
[RHBA-2019:0636]
[CVE-2019-1002101]
[https://github.com/kubernetes/kubernetes/pull/75037]
[FEDORA-2019-bf800b1c04]
[FEDORA-2019-2b8ef08c95]
An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx.cc.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41273]
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpMod case.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41276]
[USN-4042-1]
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bresenham parameters.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274]
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274]
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec in Function.cc for the psOpRoll case.
[https://forum.xpdfreader.com/viewtopic.php?f=3&t=41276]
PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.
[https://github.com/sharemice/phpcms_xss/blob/master/index.html]
[https://sharemice.github.io/phpcms_xss/]
Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.
[https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2019-002.md]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1003]
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
[http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html]
[http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming]
[RHBA-2019:0326]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266]
[46453]
[46572]
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
[http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html]
[http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming]
[RHBA-2019:0326]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266]
[46572]
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
[http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html]
[http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming]
[RHBA-2019:0326]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266]
[46572]
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
[106680]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-16/#SECURITY-868]
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
[106680]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-16/#SECURITY-901]
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
[RHSA-2019:0739]
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292]
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1293]
A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20(1)]
A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20(2)]
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-859]
A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.
[RHBA-2019:0326]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1095]
An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.
[RHBA-2019:0326]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102]
A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.
[RHBA-2019:0326]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201]
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
[RHBA-2019:0326]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204]
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
[RHBA-2019:0326]
[RHBA-2019:0327]
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253]
An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20(1)]
An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20(2)]
A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1302]
An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-602]
An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-797]
A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-818]
An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-886]
A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1153]
A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.
[https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1271]
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
[107295]
[RHSA-2019:0739]
[https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1320]
A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[107295]
[https://jenkins.io/security/advisory/2019-02-19/#SECURITY-876]
A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message.
[107295]
[https://jenkins.io/security/advisory/2019-02-19/#SECURITY-985]
A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP response code if successful, and exception error message otherwise.
[107295]
[https://jenkins.io/security/advisory/2019-02-19/#SECURITY-817]
A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint.
[107295]
[https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1033]
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
[107476]
[RHSA-2019:0739]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1)]
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
[107476]
[RHSA-2019:0739]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(2)]
A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
[107476]
[RHSA-2019:0739]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339]
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
[107476]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1340]
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
[107476]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1338]
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.
[107476]
[RHSA-2019:0739]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1342]
An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTemplate.java, src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to perform the 'verify configuration' form validation action, thereby obtaining limited information about the Azure configuration.
[107476]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1330]
A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java that allows attackers with Overall/Read permission to attach a public IP address to an Azure VM agent.
[107476]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1331]
An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
[107476]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1332]
An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.
[107476]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958]
An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/appd/AppDynamicsResultsPublisher.java that allows attackers without permission to obtain passwords configured in jobs to obtain them.
[107476]
[https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1087]
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[RHSA-2019:1423]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353]
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[RHSA-2019:1423]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353]
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[RHSA-2019:1423]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361]
A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976]
A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976]
A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-846]
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992]
A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992]
A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration.
[[oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins]
[107628]
[https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1089]
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
[107901]
[RHBA-2019:1605]
[https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289]
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
[107889]
[RHBA-2019:1605]
[https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1327]
Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-829]
Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-831]
Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-839]
Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-837]
Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-954]
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956]
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-965]
A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974]
A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974]
Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1041]
Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1042]
Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-830]
Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-832]
Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835]
Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-838]
Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-841]
Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-842]
Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-945]
Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-949]
Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-952]
Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-957]
Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-961]
Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-962]
Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-964]
Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-966]
A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-977]
A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-977]
A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-979]
A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-979]
A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-981]
A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-981]
A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-991]
A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-991]
A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-993]
A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-993]
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1037]
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1037]
Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1043]
Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1044]
A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1054]
A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1054]
A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1058]
A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1058]
Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1059]
Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1061]
Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1062]
Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1069]
A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1084]
A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1084]
Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.app/Contents/MacOS/Calculator file.
[https://drive.google.com/file/d/1cmWixK1vAh7oZ2y3Y3ZtVeSoTRp8c1Ts/view?usp=sharing]
[https://evernote.com/security/updates]
[https://www.inputzero.io/2019/04/evernote-cve-2019-10038.html]
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication.
[https://github.com/PAGalaxyLab/VulInfo/blob/master/D-Link/DIR-816/edit_web_and_sys_account/README.md]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1001, CVE-2019-1056, CVE-2019-1059.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1004]
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication.
[https://github.com/PAGalaxyLab/VulInfo/blob/master/D-Link/DIR-816/remote_cmd_exec_0/README.md]
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication.
[https://github.com/PAGalaxyLab/VulInfo/blob/master/D-Link/DIR-816/edit_sys_account/README.md]
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication.
[https://github.com/PAGalaxyLab/VulInfo/blob/master/D-Link/DIR-816/reset_router/README.md]
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.
[107610]
[https://github.com/blazeinfosec/advisories/blob/master/telegram-advisory.txt]
The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her (if the session is still active).
[https://www.secureauth.com/labs/advisories]
An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information.
[https://www.secureauth.com/labs/advisories]
A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be used to access the uploaded file. If a malicious user shares an uploaded HTML file containing JavaScript code with another user of the application, and tricks an authenticated victim into accessing a URL that results in the HTML code being interpreted by the web browser, then the included JavaScript code is executed under the context of the victim user session.
[https://www.secureauth.com/labs/advisories]
The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in command execution on the underlying operating system, with the privileges of the local user running the web server. The attacker must be authenticated into the application with an administrator user account in order to be able to edit the affected plugin configuration.
[https://www.secureauth.com/labs/advisories]
It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code (that is executed in the context of the victim user to obtain sensitive information such as session identifiers and perform actions on behalf of him/her).
[https://www.secureauth.com/labs/advisories]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0920, CVE-2019-0988, CVE-2019-1055, CVE-2019-1080.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1005]
A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.
[https://lists.openinfosecfoundation.org/pipermail/oisf-announce/]
[https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/]
An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft.new_chunk }" item, then the program enters an smb/files.rs error condition and crashes.
[https://github.com/OISF/suricata/pull/3734]
[https://redmine.openinfosecfoundation.org/issues/2896]
[https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/]
An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to access a part of a DHCP packet. At this point, the Rust environment runs into a panic in parse_clientid_option in the dhcp/parser.rs file.
[https://redmine.openinfosecfoundation.org/issues/2902]
[https://redmine.openinfosecfoundation.org/issues/2947]
[https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/]
An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.
[https://lists.openinfosecfoundation.org/pipermail/oisf-announce/]
[https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/]
An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file.
[https://redmine.openinfosecfoundation.org/issues/2943]
[https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/]
An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part2, leading to a crash within the ftp/mod.rs file.
[https://redmine.openinfosecfoundation.org/issues/2949]
[https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/]
An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function DecodeEthernet in decode-ethernet.c is executed a second time. At this point, the algorithm cuts the first part of the packet and doesn't determine the current length. Specifically, if the packet is exactly 28 long, in the first iteration it subtracts 14 bytes. Then, it is working with a packet length of 14. At this point, the case distinction says it is a valid packet. After that it casts the packet, but this packet has no type, and the program crashes at the type case distinction.
[https://redmine.openinfosecfoundation.org/issues/2946]
[https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/]
Various Lexmark products have CSRF.
[http://support.lexmark.com/index?page=content&id=TE921&locale=EN&userlocale=EN_US]
Various Lexmark products have Incorrect Access Control.
[http://support.lexmark.com/index?page=content&id=TE922&locale=EN&userlocale=EN_US]
The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.
[http://support.lexmark.com/index?page=content&id=TE923&locale=EN&userlocale=EN_US]
An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1006]
The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execute arbitrary code via a long configuration key value. An attacker must be able to download files to the device in order to exploit this vulnerability.
[https://github.com/VerSprite/research/blob/master/advisories/VS-2019-002.md]
utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
[https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b]
[https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563]
[https://www.npmjs.com/advisories/789]
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.
[RHSA-2019:1024]
[RHSA-2019:1143]
[https://github.com/flatpak/flatpak/issues/2782]
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment in order to cause execution of JavaScript in the context of OTRS.
[https://community.otrs.com/security-advisory-2019-06-security-update-for-otrs-framework/]
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS.
[https://community.otrs.com/security-advisory-2019-05-security-update-for-otrs-framework/]
An issue was discovered in Kentico before 12.0.15. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.
[https://devnet.kentico.com/download/hotfixes#securityBugs-v12]
In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.
[https://github.com/godotengine/godot/pull/27398]
[https://godotengine.org/news]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1021, CVE-2019-1022, CVE-2019-1026, CVE-2019-1027, CVE-2019-1028.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1007]
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
[[tapestry-users] 20190913 CVE-2019-10071: Apache Tapestry vulnerability disclosure]
[[tapestry-users] 20191014 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure]
[[tapestry-users] 20191007 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure]
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
[108874]
[https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E]
[https://security.netapp.com/advisory/ntap-20190625-0002/]
[https://support.f5.com/csp/article/K17321505]
[USN-4128-1]
[USN-4128-2]
[https://www.synology.com/security/advisory/Synology_SA_19_29]
The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616
[[ofbiz-dev] 20190910 [CVE-2019-10073] Apache OFBiz XSS vulnerability in the "ecommerce" component]
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533
[[ofbiz-notifications] 20190913 [jira] [Updated] (OFBIZ-11006) Create customer request screen breaks when entering special characters (CVE-2019-10074)]
[[ofbiz-dev] 20190910 [CVE-2019-10074] Apache OFBiz RCE (template injection)]
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
[[oss-security] 20190519 [CVE-2019-10076] Apache JSPWiki Cross-site scripting vulnerability]
[108437]
[https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10076]
[[jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures]
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
[[oss-security] 20190519 [CVE-2019-10077] Apache JSPWiki Cross-site scripting vulnerability]
[108437]
[https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10077]
[[jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures]
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
[[oss-security] 20190519 [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability]
[108437]
[https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078]
[[jspwiki-dev] 20190519 [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki]
[[jspwiki-dev] 20190521 Re: [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki]
[[jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures]
A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008]
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
[openSUSE-SU-2019:2051]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[20190826 [SECURITY] [DSA 4509-1] apache2 security update]
[GLSA-201909-04]
[https://security.netapp.com/advisory/ntap-20190905-0003/]
[USN-4113-1]
[DSA-4509]
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
[https://httpd.apache.org/security/vulnerabilities_24.html]
In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on that page.
[108816]
[https://lists.apache.org/thread.html/88c064c95da2f41d5435ca5b3e364925bed72cc73bcec9b3f25e4c07@%3Cdev.allura.apache.org%3E]
[[announce] 20190618 CVE-2019-10085 Apache Allura XSS vulnerability]
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
[openSUSE-SU-2019:2058]
[[www-announce] 20190815 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.]
[[commons-issues] 20190925 [GitHub] [commons-validator] jeff-schram opened a new pull request #18: Update pom.xml]
[[commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.]
[[shiro-dev] 20191001 [jira] [Created] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fiix]
[[tinkerpop-commits] 20190829 [tinkerpop] branch master updated: Bump commons-beanutils to 1.9.4 for CVE-2019-10086 - CTR]
[[commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.]
[[shiro-dev] 20191001 [jira] [Commented] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fix]
[[shiro-dev] 20191001 [jira] [Updated] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fix]
[[debian-lts-announce] 20190824 [SECURITY] [DLA 1896-1] commons-beanutils security update]
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
[https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087]
A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
[https://lists.apache.org/thread.html/1c63555609b737c20d1bbfa4a3e73ec488e3408a84e2f5e47e1b7e08@%3Cdev.tika.apache.org%3E]
[[tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[[tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[[tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[https://security.netapp.com/advisory/ntap-20190828-0004/]
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
[https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10089]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[[tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[[tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[[tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1009]
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
[https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10090]
In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[debian-lts-announce] 20190930 [SECURITY] [DLA 1900-2] apache2 regression update]
In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
[[tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[https://lists.apache.org/thread.html/a5a44eff1b9eda3bc69d22943a1030c43d376380c75d3ab04d0c1a21@%3Cdev.tika.apache.org%3E]
[[tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[[tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[https://security.netapp.com/advisory/ntap-20190828-0004/]
A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
[[tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[[tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[[tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}]
[https://lists.apache.org/thread.html/fe876a649d9d36525dd097fe87ff4dcb3b82bb0fbb3a3d71fb72ef61@%3Cdev.tika.apache.org%3E]
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
[https://access.redhat.com/security/cve/cve-2019-10097]
[https://httpd.apache.org/security/vulnerabilities_24.html]
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.
[https://httpd.apache.org/security/vulnerabilities_24.html]
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
[https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e@%3Cuser.spark.apache.org%3E]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1010]
In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.
[https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/]
Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).
[https://github.com/leanote/leanote/issues/719]
SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189.
[https://sourceforge.net/p/sox/bugs/299/]
[https://sourceforge.net/p/sox/code/ci/master/tree/src/xa.c#l219]
HexoEditor v1.1.8-beta is affected by: XSS to code execution.
[https://github.com/Moeditor/Moeditor/issues/156]
[https://github.com/zhuzhuyule/HexoEditor/issues/3]
Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.
[http://bugzilla.maptools.org/show_bug.cgi?id=2745]
[openSUSE-SU-2019:1908]
[https://bugzilla.gnome.org/show_bug.cgi?id=788980]
[[debian-lts-announce] 20190813 [SECURITY] [DLA 1881-1] evince security update]
[[debian-lts-announce] 20190813 [SECURITY] [DLA 1882-1] atril security update]
[USN-4067-1]
OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). The impact is: Theoretically low, but might potentially enable persistent XSS (user could embed mal. code). The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "My Account" page. File: Lib/listjs/list.js, line 67. The attack vector is: unknown, victim must open profile page if persistent was possible.
[https://github.com/emoncms/emoncms/issues/763]
DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote Execution, Credential Leaks. The component is: IoT API. The attack vector is: Any Accessible Server.
[https://gist.github.com/kaendfinger/3ad1dbeb62f902cc3ac2867f4e01ae38]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10753, CVE-2018-10771. Reason: This candidate is a reservation duplicate of CVE-2018-10753 and CVE-2018-10771. Notes: All CVE users should reference CVE-2018-10753 and CVE-2018-10771 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.
[https://github.com/Dolibarr/dolibarr/issues/7962]
libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.
[https://github.com/savon-noir/python-libnmap/issues/87]
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.
[https://github.com/zammad/zammad/compare/5c983f6...1a9af7d]
[https://github.com/zammad/zammad/compare/ea50d0c...238784d]
[https://github.com/zammad/zammad/issues/1869]
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.
[https://sourceware.org/bugzilla/show_bug.cgi?id=22850]
GNU Libc current is affected by: Re-mapping current loaded libray with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code.
[109167]
[https://sourceware.org/bugzilla/show_bug.cgi?id=22851]
[https://support.f5.com/csp/article/K11932200?utm_source=f5support&utm_medium=RSS]
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc.
[109162]
[https://sourceware.org/bugzilla/show_bug.cgi?id=22852]
[https://support.f5.com/csp/article/K06046097]
[https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS]
** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."
[https://sourceware.org/bugzilla/show_bug.cgi?id=22853]
[https://support.f5.com/csp/article/K06046097]
[https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS]
phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/send_reply/. The attack vector is: <img src=x onerror=alert(document.domain) />.
[https://whitehatck01.blogspot.com/2018/02/school-college-portal-with-erp-script.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-11501. Reason: This candidate is a reservation duplicate of CVE-2018-11501. Notes: All CVE users should reference CVE-2018-11501 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. This function call can be triggered by any user logged-in with at least Volunteer role or manage_circulation capabilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC.
[https://plugins.trac.wordpress.org/browser/weblibrarian/trunk/includes/database_code.php]
[https://wpvulndb.com/vulnerabilities/9553]
OpenModelica OMCompiler is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: OPENMODELICAHOME parameter changeable via environment variable. The attack vector is: Changing an environment variable.
[https://trac.openmodelica.org/OpenModelica/ticket/4787#trac-add-comment]
uLaunchELF < commit 170827a is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Loader program (loader.c) overly trusts the arguments provided via command line.
[https://github.com/AKuHAK/uLaunchELF/issues/14]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-7662. Reason: This candidate is a reservation duplicate of CVE-2018-7662. Notes: All CVE users should reference CVE-2018-7662 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Quake3e < 5ed740d is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Argument string creation.
[https://github.com/ec-/Quake3e/issues/9]
borg-reducer c6d5240 is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Output parameter within the executable.
[https://github.com/archivesunleashed/borg-reducer/issues/4]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.
[https://github.com/lucasgcilento/CVE/blob/master/Dolibarr_CSRF]
nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The component is: nfx.c:546, nffile_inline.c:83, minilzo.c (redistributed). The attack vector is: nfdump must read and process a specially crafted file. The fixed version is: after commit 9f0fe9563366f62a71d34c92229da3432ec5cf0e.
[https://github.com/phaag/nfdump/issues/104]
[FEDORA-2019-0fbfb00cbb]
[FEDORA-2019-9013b5e75d]
NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846, CVE-2018-3847, CVE-2018-3848, and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character.
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892458]
[https://github.com/astropy/astropy/pull/7274]
[https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio3420.tar.gz]
[https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio3430.tar.gz]
[https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/docs/changes2.txt]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10364. Reason: This candidate is a reservation duplicate of CVE-2018-10364. Notes: All CVE users should reference CVE-2018-10364 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.
[https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8]
[https://github.com/pluck-cms/pluck/issues/44]
The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image.
[https://github.com/sleuthkit/sleuthkit/commit/114cd3d0aac8bd1aeaf4b33840feb0163d342d5b]
[https://issuetracker.google.com/issues/77809383]
[FEDORA-2019-52f83932a1]
[FEDORA-2019-2e68c0a0ee]
Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registers. The component is: ioctl handling. The attack vector is: An attacker could exploit a bug in ioctl interface whitelist checking, in order to write to model specific registers, normally a function reserved for the root user. The fixed version is: v1.2.0.
[https://github.com/LLNL/msr-safe/compare/v1.1.0...v1.2.0]
[https://www.tldp.org/LDP/lkmpg/2.4/html/x856.html]
moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txt_add. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae.
[https://drive.google.com/drive/u/2/folders/1Y2IbtEr9v4l4Ruie_AY9BFJOHOGiDt7S]
[https://github.com/leesavide/abcm2ps/issues/18]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10238. Reason: This issue was MERGED into CVE-2018-10238 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2018-10238 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.
[https://www.palletsprojects.com/blog/flask-1-0-released/]
Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is: Incorrect calls to _ensure_auth() wrapper result in authentication-checking not being applied to al routes.
[https://github.com/bigpresh/Dancer-Plugin-SimpleCRUD/pull/109]
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.
[https://github.com/tinymce/tinymce/issues/4394]
domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.
[https://github.com/domainmod/domainmod/issues/65]
domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: http://127.0.0.1/admin/users/add.php. The attack vector is: After the administrator logged in, open the html page.
[https://github.com/domainmod/domainmod/issues/65]
domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.
[https://github.com/domainmod/domainmod/issues/65]
JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack.
[https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/]
[https://medium.com/bugbountywriteup/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb]
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables (ALL executables on the web site). The attack vector is: CAPEC-471, CWE-426, CWE-427.
[http://seclists.org/oss-sec/2018/q2/146]
Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution with escalation of privilege. The component is: Executable installer, portable executable (ALL executables available). The attack vector is: CWE-29, CWE-377, CWE-379.
[http://seclists.org/oss-sec/2018/q2/146]
TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: like_escape is used in Quick-chat.php line 399. The attack vector is: Crafted ajax request.
[https://metalamin.github.io/Quick-Chat-SQLi-EN/]
OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3.
[https://github.com/LiodAir/images/blob/master/csrf.md]
Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link (A) element.
[https://drive.google.com/drive/folders/1UxgdL8SJO6KKnG3bh0-LTl7C6i41VwoW?usp=sharing]
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via /assets/components/gallery/connector.php.
[https://modx.pro/security/15912#comment-99640]
[https://modx.today/posts/2018/07/critical-security-vulnerability-in-gallery-1.7.1]
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.
[http://104.207.151.48/woo-feed-manage-list.php]
[http://packetstormsecurity.com/files/154263/WordPress-WooCommerce-Product-Feed-2.2.18-Cross-Site-Scripting.html]
[https://wpvulndb.com/vulnerabilities/9856]
[https://www.youtube.com/watch?v=T-sqQDFRRBg]
VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.cpp. The attack vector is: The victim must open a specially crafted VCF file.
[https://docs.google.com/document/d/e/2PACX-1vQJveVcGMp_NMdBY5Je2K2k63RoCYznvKjJk5u1wJRmLotvwQkG5qiqZjpABcOkjzj49wkwGweiFwrc/pub]
[https://github.com/vcftools/vcftools/issues/141]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-1010127. Reason: This candidate is a reservation duplicate of CVE-2019-1010127. Notes: All CVE users should reference CVE-2019-1010127 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The impact is: PLC Wireless Router's are vulnerable to an unauthenticated remote reboot due. The component is: Reboot settings are available to unauthenticated users instead of only authenticaed users. The attack vector is: Remote.
[Exploit Database]
[https://www.shodan.io/search?query=title%3APLC++pstVal-%3Evalue%3Ahtml%2Findex.html]
scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacketListField.getfield(self..). The attack vector is: over the network or in a pcap. both work.
[106674]
[https://github.com/secdev/scapy/pull/1409]
[https://github.com/secdev/scapy/pull/1409/files#diff-441eff981e466959968111fc6314fe93L1058]
[FEDORA-2019-47946eb312]
[https://www.imperva.com/blog/scapy-sploit-python-network-tool-is-vulnerable-to-denial-of-service-dos-attack-cve-pending/]
Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.
[https://drive.google.com/open?id=1sk5IklziyEggeWpWE4Wyk9xqa30CjNpS]
zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.
[https://gist.github.com/Lz1y/acd1bfd0cc0e0f53b8f781840e7bf368]
zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.
[https://gist.github.com/Lz1y/e82eb9cc776e629b9d1874dc689421eb]
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.
[https://gist.github.com/Lz1y/7ab529230c43dfc5441ac32dd13e3e5b]
zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php.
[https://gist.github.com/Lz1y/24a6368c7ffdc1af7292035dd16a97f5]
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.
[https://gist.github.com/Lz1y/cfb2f8179003b91404ad029333508f4c]
zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.
[https://gist.github.com/Lz1y/31595b060cd6a031896fdf2b3a1273f5]
** DISPUTED ** D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is accessible without authentication, it can't actually configure anything. Thus, there is no denial of service or information leakage.
[109351]
[https://cxsecurity.com/issue/WLB-2018080199]
[https://www.youtube.com/watch?v=7sk6agpcA_s]
[https://youtu.be/BQQbp2vn_wY]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-1010155. Reason: This candidate is a duplicate of CVE-2019-1010155. Notes: All CVE users should reference CVE-2019-1010155 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(crafting user-controlled input to bypass authentication). The fixed version is: 0.023.
[https://github.com/DCIT/perl-Crypt-JWT/issues/3#issuecomment-417947483]
jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcmpDict (jsiChar.c:121). The attack vector is: The victim must execute crafted javascript code. The fixed version is: 2.4.77.
[https://jsish.org/fossil/jsi/tktview/5533c4d665b9683eebe4d662493f15eb911d1c8f]
Socusoft Co Photo 2 Video Converter 8.0.0 is affected by: Buffer Overflow - Local shell-code execution and Denial of Service. The impact is: Local privilege escalation (dependant upon conditions), shell code execution and denial-of-service. The component is: pdmlog.dll library. The attack vector is: The attacker must have access to local system (either directly, or remotley).
[https://packetstormsecurity.com/files/145181/SocuSoft-Co.-Photo-2-Video-Converter-8.0.0-Code-Execution-DoS.html]
[https://ret2eax.github.io/posts/socusoft-bof.html]
[Exploit Database]
Jsish 2.4.77 2.0477 is affected by: Out-of-bounds Read. The impact is: denial of service. The component is: function lexer_getchar (jsiLexer.c:9). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.
[https://jsish.org/fossil/jsi/tktview/3a069014976f3422d9d96821dc555c8326c02ae3]
Jsish 2.4.77 2.0477 is affected by: Use After Free. The impact is: denial of service. The component is: function Jsi_ObjFree (jsiObj.c:230). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.
[https://jsish.org/fossil/jsi/tktview/870f496bb8a707491df8026e2ff78b33a5cf44c1]
Jsish 2.4.83 2.0483 is affected by: Nullpointer dereference. The impact is: denial of service. The component is: function jsi_DumpFunctions (jsiEval.c:567). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.84.
[https://jsish.org/fossil/jsi/tktview/a3026a7c06e0f41af461aa0bc2f7a7e886209390]
Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. The impact is: denial of service. The component is: function jsiValueGetString (jsiUtils.c). The attack vector is: executing crafted javascript code. The fixed version is: after commit f3a8096e0ce44bbf36c1dcb6e603adf9c8670c39.
[https://jsish.org/fossil/jsi/tktview/16f01b0177c2e309ab01102feb76b39d57a3eb66]
Jsish 2.4.84 2.0484 is affected by: Reachable Assertion. The impact is: denial of service. The component is: function Jsi_ValueArrayIndex (jsiValue.c:366). The attack vector is: executing crafted javascript code. The fixed version is: after commit 738ead193aff380a7e3d7ffb8e11e446f76867f3.
[https://jsish.org/fossil/jsi/tktview/b3278d1a441477d50363d28df79bbf58de2448af]
CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector is: Loading an image from a user-controllable url can lead to command injection, because no string sanitization is done on the url. The fixed version is: v.2.3.4.
[https://framagit.org/dtschump/CImg/commit/5ce7a426b77f814973e56182a0e76a2b04904146]
[[debian-lts-announce] 20190928 [SECURITY] [DLA 1934-1] cimg security update]
JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execution. The component is: function lit_char_to_utf8_bytes (jerry-core/lit/lit-char-helpers.c:377). The attack vector is: executing crafted javascript code. The fixed version is: after commit 505dace719aebb3308a3af223cfaa985159efae0.
[https://github.com/jerryscript-project/jerryscript/issues/2476]
Jsish 2.4.70 2.047 is affected by: Use After Free. The impact is: denial of service and possibly arbitrary code execution. The component is: function Jsi_RegExpNew (jsi/jsiRegexp.c:39). The attack vector is: executing crafted javascript code. The fixed version is: after commit 48a66c798d.
[https://jsish.org/fossil/jsi/tktview?name=65c8965977]
Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is: https://github.com/modxcms/fred/commit/139cefac83b2ead90da23187d92739dec79d3ccd and https://github.com/modxcms/fred/commit/01f0a3d1ae7f3970639c2a0db1887beba0065246.
[https://www.youtube.com/watch?v=vOlw2DP9WbE]
PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injection'). The impact is: It is possible to manipulate gpg-keys or execute commands remotely. The component is: function pgp_exec() phkp.php:98. The attack vector is: HKP-Api: /pks/lookup?search.
[https://github.com/remko/phkp/issues/1]
GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.
[109367]
[https://sourceware.org/bugzilla/show_bug.cgi?id=23657]
yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a malicious YAML document. The fixed version is: 0.4.1 and later.
[https://github.com/chyh1990/yaml-rust/pull/109]
serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all deserialization functions). The attack vector is: Parsing a malicious YAML file. The fixed version is: 0.8.4 and later.
[https://github.com/dtolnay/serde-yaml/pull/105]
mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS, the program does never terminates. The component is: g3/g32pbm.c. The attack vector is: Local, the user should open a specially crafted file. The fixed version is: 1.2.1.
[FEDORA-2019-732b5488c2]
[https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty/]
mgetty prior to 1.2.1 is affected by: out-of-bounds read. The impact is: DoS, the program may crash if the memory is not mapped. The component is: putwhitespan() in g3/pbm2g3.c. The attack vector is: Local, the victim must open a specially crafted file. The fixed version is: 1.2.1.
[https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty/]
marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is: Hacker inputs a SQL to a vulnerable vector(header, http parameter, etc). The fixed version is: 1.6.
[https://github.com/basecamp/marginalia/pull/73/]
hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS).
[https://github.com/hisiphp/hisiphp/issues/3]
ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
[https://github.com/ServiceStack/ServiceStack/commit/a0e0d7de20f5d1712f1793f925496def4383c610]
JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30.
[https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/]
Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The impact is: Remote code execution with the same privileges as the servers. The component is: Two web servers in the projects expose three vulnerable endpoints that can be accessed remotely. The endpoints are defined at: - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/merlin_model_server/api.js#L34 - /alignment: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#L28 - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#L65. The attack vector is: Attacker sends a GET request to the vulnerable endpoint with a specially formatted query parameter. The fixed version is: After commit f6660e6d8f0d1d931359d591dbdec580fef36d36.
[https://github.com/google/voice-builder/commit/c145d4604df67e6fc625992412eef0bf9a85e26b]
[https://github.com/google/voice-builder/commit/f6660e6d8f0d1d931359d591dbdec580fef36d36]
Jeesite 1.2.7 is affected by: SQL Injection. The impact is: sensitive information disclosure. The component is: updateProcInsIdByBusinessId() function in src/main/java/com.thinkgem.jeesite/modules/act/ActDao.java has SQL Injection vulnerability. The attack vector is: network connectivity,authenticated. The fixed version is: 4.0 and later.
[https://github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/dao/ActDao.java]
Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The attack vector is: network connectivity,authenticated,must upload a specially crafted xml file. The fixed version is: 4.0 and later.
[https://github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/service/ActProcessService.java]
GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.
[https://security.netapp.com/advisory/ntap-20190822-0001/]
[https://sourceware.org/bugzilla/show_bug.cgi?id=23765]
LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff) is affected by: Directory Traversal. The impact is: The vulnerability allows an attacker to access any file (with a fixed extension) on the server. The component is: A web-view renderer; details here: https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1. The attack vector is: Attacker sends a specially crafted HTTP request.
[https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1]
OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.
[https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java]
Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting (XSS). The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/her account. The fixed version is: 3.0.16.
[https://0day.today/exploit/31255]
[https://packetstormsecurity.com/files/149665/wppieregister3015-xss.txt]
[https://seclists.org/bugtraq/2018/Oct/16]
IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buffer Overflow. The impact is: Minor information disclosure of kernel stack. The component is: Veracrypt NT Driver (veracrypt.sys). The attack vector is: Locally executed code, IOCTL request to driver. The fixed version is: 1.23-Hotfix-1.
[https://github.com/veracrypt/VeraCrypt/commit/f30f9339c9a0b9bbcc6f5ad38804af39db1f479e]
GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14.
[https://gist.github.com/pouyadarabi/467d3167551fb0712d3264c72db092af]
[https://github.com/cryptoapi/Bitcoin-Wordpress-Plugin/blob/8aa17068d7ba31a05f66e0ab2bbb55efb0f60017/gourl.php#L5637]
[https://www.youtube.com/watch?v=K2HElM_ZYu4]
Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The component is: Main cherokee command. The attack vector is: Overwrite argv[0] to an insane length with execl. The fixed version is: There's no fix yet.
[https://i.imgur.com/PWCCyir.png]
tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". The attack vector is: The victim must open a specially crafted pcap file.
[openSUSE-SU-2019:1964]
[https://github.com/the-tcpdump-group/tcpdump/blob/master/print-hncp.c]
[https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9.2/print-hncp.c]
[https://github.com/the-tcpdump-group/tcpdump/commits/master/print-hncp.c]
LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell session. The component is: adb shell (patches to fix this are at https://review.lineageos.org/c/LineageOS/android_system_core/+/234800, https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799). The attack vector is: When adb is enabled, and an attacker has physical access, `adb shell setprop service.adb.root 1` allows restarting adb as root.
[https://gist.github.com/zifnab06/e31ad63596b63a95e061bfe1f49ff0a7]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19801. Reason: This candidate is a reservation duplicate of CVE-2018-19801. Notes: All CVE users should reference CVE-2018-19801 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19800. Reason: This candidate is a reservation duplicate of CVE-2018-19800. Notes: All CVE users should reference CVE-2018-19800 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19802. Reason: This candidate is a reservation duplicate of CVE-2018-19802. Notes: All CVE users should reference CVE-2018-19802 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
[FEDORA-2019-4349fc0afb]
[FEDORA-2019-12650a34d8]
[https://support.dcmtk.org/redmine/issues/858]
Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) is affected by: Buffer Overflow. The impact is: remote dos. The component is: slaxlexer.c:601(funtion:slaxGetInput). The attack vector is: ./slaxproc --slax-to-xslt POC0.
[https://bugzilla.redhat.com/show_bug.cgi?id=1649175]
The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: network connectivity.
[https://drive.google.com/file/d/1OkMtrMgjjINsDUQwxpGxjbATB6hiwqyv/view?usp=sharing]
Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.
[https://somerandomshitwbu.blogspot.com/2019/01/stored-xss-in-frog-cms-open-source.html]
Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap (attacker) / Corrections view (victim). The fixed version is: 5.3.12.
[https://docu.ilias.de/goto_docu_pg_116867_35.html]
[https://github.com/ILIAS-eLearning/ILIAS/commit/b9150b7194f8cfb1178ca3674a0b3c86b7cd92f5]
[https://github.com/ILIAS-eLearning/ILIAS/commit/f1c2f906410bf35bb6bd45efff57d2e8da3b3825]
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
[RHBA-2019:2824]
[RHSA-2019:2571]
[RHSA-2019:2582]
[RHSA-2019:2594]
[https://gitlab.gnome.org/GNOME/pango/blob/master/pango/pango-bidi-type.c]
[FEDORA-2019-547be4a683]
[FEDORA-2019-155e34df5a]
[20190812 [SECURITY] [DSA 4496-1] pango1.0 security update]
[GLSA-201909-03]
[USN-4081-1]
[DSA-4496]
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.
[https://github.com/DaveGamble/cJSON/commit/be749d7efa7c9021da746e685bd6dec79f9dd99b]
[https://github.com/DaveGamble/cJSON/issues/315]
Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job.
[109320]
[https://docs.google.com/document/d/1MBEoJSMvkjp5Kua0bRD_kiDBisL0fOCwTL9uMWj4lGA/edit?usp=sharing]
The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The attack vector is: network connectivity. The fixed version is: 1.15.
[https://drive.google.com/open?id=1OkMtrMgjjINsDUQwxpGxjbATB6hiwqyv]
[https://gerrit.onosproject.org/#/c/20767/]
MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.
[https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9]
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.
[https://github.com/zmartzone/mod_auth_openidc/commit/132a4111bf3791e76437619a66336dce2ce4c79b]
[https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.3.10.2]
[[debian-lts-announce] 20190823 [SECURITY] [DLA 1894-1] libapache2-mod-auth-openidc security]
[https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2019-001_mod_auth_openidc_reflected_xss.txt]
Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1.
[https://sourceforge.net/projects/i-doit/files/i-doit/1.12.1/CHANGELOG/download]
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
[https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD]
[https://drive.google.com/open?id=1LxmTXZS-FRJQHAzO2JPgDx5SbLNEJHuJ]
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
[https://drive.google.com/open?id=17RsaP67w6M2xquQjFf2vXhX3dlVKMdC1]
[https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD]
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.
[https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe]
[https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b]
[https://redmine.openinfosecfoundation.org/issues/2736]
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: applyFlowRules() and apply() functions in FlowRuleManager.java. The attack vector is: network management and connectivity.
[https://drive.google.com/open?id=1ce1uqcJYI-sEENGbPmmw-uJTwCXTUyJn]
[https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD]
An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.
[https://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html]
[20190326 [article2pdf (Wordpress plug-in)] Multiple vulnerabilities (CVE-2019-1000031, CVE-2019-1010257)]
[https://wordpress.org/support/topic/pdf-download-path-improperly-sanitised/]
[https://wpvulndb.com/vulnerabilities/9246]
nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function nsvg__parseColorRGB in src/nanosvg.h / line 1227. The attack vector is: It depends library usage. If input is passed from the network, then network connectivity is enough. Most likely an attack will require opening a specially crafted .svg file.
[https://0day.work/cve-2019-1000032-memory-corruption-in-nanosvg/]
[https://github.com/memononen/nanosvg/]
[https://github.com/memononen/nanosvg/issues/136]
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
[https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534]
[https://github.com/saltstack/salt/pull/51462]
[https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a]
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
[https://github.com/shyiko/ktlint/pull/332]
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.
[https://github.com/go-gitea/gitea/pull/5905]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-1010142. Reason: This candidate is a reservation duplicate of CVE-2019-1010142. Notes: All CVE users should reference CVE-2019-1010142 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.
[https://github.com/DCIT/perl-Crypt-JWT/commit/b98a59b42ded9f9e51b2560410106207c2152d6c]
[https://www.openwall.com/lists/oss-security/2018/09/07/1]
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
[https://github.com/lodash/lodash/issues/3359]
[https://github.com/lodash/lodash/wiki/Changelog]
[https://security.netapp.com/advisory/ntap-20190919-0004/]
[https://snyk.io/vuln/SNYK-JS-LODASH-73639]
Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.
[https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688]
[https://www.exploit-db.com/exploits/43113]
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.
[https://github.com/helm/helm/pull/3152]
[https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50]
[https://github.com/helm/helm/releases/tag/v2.7.2]
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b). The attack vector is: An attacker can trigger the vulnerability by a specifically crafted network TCP session. The fixed version is: 4.1.3.
[https://github.com/OISF/suricata/pull/3625]
[https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b]
[https://redmine.openinfosecfoundation.org/issues/2770]
Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connection() in src/callback.c. The attack vector is: network connectivity. The fixed version is: 12.0.1-4 and later.
[https://forge.univention.org/bugzilla/show_bug.cgi?id=48427]
[https://github.com/univention/univention-corporate-server/commit/a28053045bd2e778c50ed1acaf4e52e1e34f6e34]
Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.
[https://sourceforge.net/p/tsheetx/code/497/tree/branches/legacy/login.php#l40]
[https://sourceforge.net/p/tsheetx/discussion/779083/thread/7fcb52f696/]
Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" parameter. The component is: redirect.php. The attack vector is: The victim must open a link created by an attacker. Attacker may use any legitimate site using Babel to redirect user to a URL of his/her choosing.
[http://dev.cmsmadesimple.org/project/files/729]
[https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/]
Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory which the TA can access. The component is: optee_os. The fixed version is: v3.4.0.
[https://github.com/OP-TEE/optee_os/commit/e3adcf566cb278444830e7badfdcc3983e334fd1]
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component is: optee_os. The fixed version is: 3.4.0 and later.
[https://github.com/OP-TEE/optee_os/commit/95f36d661f2b75887772ea28baaad904bde96970]
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. The component is: optee_os. The fixed version is: 3.4.0 and later.
[https://github.com/OP-TEE/optee_os/commit/7e768f8a473409215fe3fff8f6e31f8a3a0103c6]
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: optee_os. The fixed version is: 3.4.0 and later.
[https://github.com/OP-TEE/optee_os/commit/d5c5b0b77b2b589666024d219a8007b3f5b6faeb]
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
[https://github.com/OP-TEE/optee_os/commit/b60e1cee406a1ff521145ab9534370dfb85dd592]
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core (kernel) context. The component is: optee_os. The fixed version is: 3.4.0 and later.
[https://github.com/OP-TEE/optee_os/commit/a637243270fc1faae16de059091795c32d86e65e]
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
[https://github.com/OP-TEE/optee_os/commit/70697bf3c5dc3d201341b01a1a8e5bc6d2fb48f8]
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.
[https://github.com/rust-lang/rust/issues/53566]
[https://github.com/rust-lang/rust/pull/53571/commits/b85e4cc8fadaabd41da5b9645c08c68b8f89908d]
JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This issue, which was fixed in Kotlin plugin version 1.3.30, is similar to CVE-2019-10101.
[https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/]
mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: server_example_complex_array. The attack vector is: Send a specific MMS protocol packet.
[https://github.com/mz-automation/libiec61850/issues/127]
jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file.
[https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1838251]
[https://bugzilla.redhat.com/show_bug.cgi?id=1679952]
[https://launchpadlibrarian.net/435112680/32_crash_in_gpsinfo]
[FEDORA-2019-17b95fecd3]
[FEDORA-2019-441c2fb0d1]
jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file.
[https://bugzilla.redhat.com/show_bug.cgi?id=1679978]
[FEDORA-2019-17b95fecd3]
[FEDORA-2019-441c2fb0d1]
Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.
[https://github.com/mirumee/saleor/issues/3768]
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
[https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d]
[https://github.com/kyz/libmspack/issues/27]
[[debian-lts-announce] 20190823 [SECURITY] [DLA 1895-1] libmspack security update]
[FEDORA-2019-da6be81bd3]
[FEDORA-2019-6235a32624]
[USN-4066-1]
[USN-4066-2]
Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
[https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a22727c111f5c3]
GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it.
[https://github.com/glpi-project/glpi/blob/9.4/bugfixes/ajax/getDropdownValue.php]
[https://github.com/glpi-project/glpi/releases/tag/9.3.1]
Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file.
[https://github.com/aquaverde/aquarius-core]
[https://github.com/aquaverde/aquarius-core/commit/e1af89aa9df07ea265d879518ede9eb98aa494e0]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-9686. Reason: This candidate is a reservation duplicate of CVE-2019-9686. Notes: All CVE users should reference CVE-2019-9686 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools > Reminder > Description .. Set the description to any iframe/form tags and apply. The attack vector is: The attacker puts a login form, the user fills it and clicks on submit .. the request is sent to the attacker domain saving the data. The fixed version is: 9.4.1.
[https://github.com/glpi-project/glpi/pull/5519]
[https://github.com/glpi-project/glpi/releases/tag/9.3.1]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11454. Reason: This candidate is a reservation duplicate of CVE-2019-11454. Notes: All CVE users should reference CVE-2019-11454 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11455. Reason: This candidate is a reservation duplicate of CVE-2019-11455. Notes: All CVE users should reference CVE-2019-11455 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.
[https://github.com/go-gitea/gitea/releases]
WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.
[https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc]
[https://github.com/dbry/WavPack/issues/65]
[USN-4062-1]
pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in a non-X11 session. The fixed version is: 0.4.
[https://github.com/leonnnn/pyxtrlock/issues/21]
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.
[https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b]
[https://github.com/dbry/WavPack/issues/66]
[FEDORA-2019-8eeb8f9d3f]
[FEDORA-2019-c72f5f6361]
[USN-4062-1]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11498. Reason: This candidate is a reservation duplicate of CVE-2019-11498. Notes: All CVE users should reference CVE-2019-11498 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.
[https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe]
[https://github.com/dbry/WavPack/issues/68]
[FEDORA-2019-8eeb8f9d3f]
[FEDORA-2019-c72f5f6361]
[USN-4062-1]
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.
[https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/]
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager.
[http://dev.cmsmadesimple.org/bug/view/12002]
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.
[http://dev.cmsmadesimple.org/bug/view/12004]
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
[http://dev.cmsmadesimple.org/bug/view/12003]
An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-members of a private project/group to add and read labels.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ce/issues/56985]
An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. EXIF geolocation data were not removed from images when uploaded to GitLab. As a result, anyone with access to the uploaded image could obtain its geolocation, device, and software version data (if present).
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ce/issues/54220]
[https://gitlab.com/gitlab-org/gitlab-ce/issues/55469]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1011]
An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The "move issue" feature may allow a user to create projects under any namespace on any GitLab instance on which they hold credentials.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ce/issues/56865]
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ce/issues/56927]
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC key was insecurely derived.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ee/issues/9730]
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4/projects/<id>/languages requests may allow Uncontrolled Resource Consumption.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ce/issues/54977]
An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing data.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ee/issues/9729]
An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The GitLab Releases feature could allow guest users access to private information like release details and code information.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ce/issues/56402]
An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Guests of a project were allowed to see Related Branches created for an issue.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is triggered after successful authentication within the Oauth/:GeoAuthController for the secondary Geo node.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ee/issues/9731]
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
[https://github.com/snipe/snipe-it/pull/6831]
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin.
[https://www.eq-3.de/Downloads/Software/CCU3-Firmware/CCU3-3.43.16/CCU3-Changelog.3.43.16.pdf]
[https://www.eq-3.de/Downloads/Software/HM-CCU2-Firmware_Updates/HM-CCU-2.41.9/HM-CCU2-Changelog.2.41.9.pdf]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1012]
On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID after a logout, aka HMCCU-154.
[https://www.eq-3.de/Downloads/Software/CCU3-Firmware/CCU3-3.43.16/CCU3-Changelog.3.43.16.pdf]
[https://www.eq-3.de/Downloads/Software/HM-CCU2-Firmware_Updates/HM-CCU-2.41.9/HM-CCU2-Changelog.2.41.9.pdf]
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin.
[https://www.eq-3.de/Downloads/Software/CCU3-Firmware/CCU3-3.43.16/CCU3-Changelog.3.43.16.pdf]
[https://www.eq-3.de/Downloads/Software/HM-CCU2-Firmware_Updates/HM-CCU-2.41.9/HM-CCU2-Changelog.2.41.9.pdf]
eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component, aka HMCCU-179. This may lead to remote code execution.
[https://www.eq-3.de/Downloads/Software/CCU3-Firmware/CCU3-3.43.16/CCU3-Changelog.3.43.16.pdf]
[https://www.eq-3.de/Downloads/Software/HM-CCU2-Firmware_Updates/HM-CCU-2.41.9/HM-CCU2-Changelog.2.41.9.pdf]
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user.
[https://github.com/rapid7/metasploit-framework/pull/11641/]
[https://www.ais.de]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a pair of pipes) after the return of vfs_poll(), and this will cause a use-after-free.
[107655]
[https://patchwork.kernel.org/patch/10828359/]
[https://security.netapp.com/advisory/ntap-20190411-0003/]
[https://support.f5.com/csp/article/K29215970]
A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.
[openSUSE-SU-2019:1716]
[openSUSE-SU-2019:1757]
[http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html]
[http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html]
[108817]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10126]
[[debian-lts-announce] 20190617 [SECURITY] [DLA 1823-1] linux security update]
[[debian-lts-announce] 20190618 [SECURITY] [DLA 1824-1] linux-4.9 security update]
[20190722 [slackware-security] Slackware 14.2 kernel (SSA:2019-202-01)]
[20190618 [SECURITY] [DSA 4465-1] linux security update]
[https://security.netapp.com/advisory/ntap-20190710-0002/]
[https://support.f5.com/csp/article/K95593121]
[USN-4093-1]
[USN-4094-1]
[USN-4095-1]
[USN-4095-2]
[USN-4117-1]
[USN-4118-1]
[DSA-4465]
A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10129]
[https://www.postgresql.org/about/news/1939/]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1013]
[https://www.zerodayinitiative.com/advisories/ZDI-19-573/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-580/]
A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130]
[https://www.postgresql.org/about/news/1939/]
An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
[openSUSE-SU-2019:1427]
[openSUSE-SU-2019:1683]
[108117]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10131]
[https://github.com/ImageMagick/ImageMagick/commit/cb1214c124e1bd61f7dd551b94a794864861592e]
[USN-4034-1]
A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.
[RHSA-2019:1264]
[RHSA-2019:1268]
[RHSA-2019:1455]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10132]
[FEDORA-2019-5f105dd2b6]
[FEDORA-2019-9210998aaa]
[https://security.libvirt.org/2019/0003.html]
[USN-4021-1]
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10133]
[https://moodle.org/mod/forum/discuss.php?d=386523]
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10134]
[https://moodle.org/mod/forum/discuss.php?d=386524]
A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load() function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10135]
[https://github.com/containerbuildsystem/osbs-client/pull/865]
It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum.
[109029]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10136]
A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137]
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138]
[https://review.opendev.org/#/c/631240/]
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.
[108396]
[RHSA-2019:2433]
[RHSA-2019:2437]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10139]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0960, CVE-2019-1017.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1014]
A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10140]
[https://security.netapp.com/advisory/ntap-20190905-0002/]
A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.
[RHSA-2019:2505]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10141]
[https://docs.openstack.org/releasenotes/ironic-inspector/ocata.html#relnotes-5-0-2-7-origin-stable-ocata]
[https://docs.openstack.org/releasenotes/ironic-inspector/pike.html#relnotes-6-0-3-4-stable-pike]
[https://docs.openstack.org/releasenotes/ironic-inspector/queens.html#relnotes-7-2-4-stable-queens]
[https://docs.openstack.org/releasenotes/ironic-inspector/rocky.html#relnotes-8-0-3-stable-rocky]
[https://docs.openstack.org/releasenotes/ironic-inspector/stein.html#relnotes-8-2-1-stable-stein]
A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10142]
** DISPUTED ** It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10143]
[https://freeradius.org/security/]
[https://github.com/FreeRADIUS/freeradius-server/pull/2666]
[FEDORA-2019-9454ce61b2]
[FEDORA-2019-4a8eeaf80e]
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10144]
[https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/]
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10145]
[https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/]
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10147]
[https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/]
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
[openSUSE-SU-2019:1524]
[http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html]
[http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html]
[http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html]
[20190611 The Return of the WIZard: RCE in Exim (CVE-2019-10149)]
[[oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit]
[[oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit]
[[oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit]
[[oss-security] 20190606 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit]
[[oss-security] 20190725 Re: Statistics for distros lists updated for 2019Q2]
[[oss-security] 20190725 Re: Statistics for distros lists updated for 2019Q2]
[[oss-security] 20190726 Re: Statistics for distros lists updated for 2019Q2]
[108679]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149]
[20190605 [SECURITY] [DSA 4456-1] exim4 security update]
[GLSA-201906-01]
[USN-4010-1]
[DSA-4456]
[https://www.exim.org/static/doc/security/CVE-2019-10149.txt]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1015]
It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.
[RHSA-2019:2989]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10150]
[https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authentication]
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
[openSUSE-SU-2019:2044]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152]
[https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140]
[https://github.com/containers/libpod/issues/3211]
[https://github.com/containers/libpod/pull/3214]
A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member.
[RHSA-2019:2037]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10153]
[https://github.com/ClusterLabs/fence-agents/pull/255]
[https://github.com/ClusterLabs/fence-agents/pull/272]
A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10154]
[https://moodle.org/mod/forum/discuss.php?d=386521]
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10155]
[https://libreswan.org/security/CVE-2019-10155/]
[FEDORA-2019-1bd9cfb718]
[FEDORA-2019-f7fb531958]
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156]
[https://github.com/ansible/ansible/pull/57188]
[[debian-lts-announce] 20190916 [SECURITY] [DLA 1923-1] ansible security update]
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.
[108734]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157]
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.
[RHSA-2019:2466]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1016]
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
[openSUSE-SU-2019:1906]
[RHSA-2019:1587]
[RHSA-2019:1700]
[RHSA-2019:2437]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160]
[https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09]
[https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e]
[https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de]
[https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468]
[[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update]
[FEDORA-2019-7df59302e0]
[FEDORA-2019-7723d4774a]
[FEDORA-2019-2b1f72899a]
[FEDORA-2019-5dc275c9f2]
[FEDORA-2019-60a1defcd1]
[FEDORA-2019-9bfb4a3e4b]
[FEDORA-2019-50772cf122]
[https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html]
[https://security.netapp.com/advisory/ntap-20190617-0003/]
[USN-4127-1]
[USN-4127-2]
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
[https://access.redhat.com/libvirt-privesc-vulnerabilities]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161]
[https://libvirt.org/git/?p=libvirt.git;a=commit;h=aed6a032cead4386472afb24b16196579e239580]
A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.
[openSUSE-SU-2019:1904]
[openSUSE-SU-2019:1921]
[https://blog.powerdns.com/2019/06/21/powerdns-authoritative-server-4-0-8-and-4-1-10-released/]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10162]
[https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-04.html]
A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.
[openSUSE-SU-2019:1904]
[openSUSE-SU-2019:1921]
[https://blog.powerdns.com/2019/06/21/powerdns-authoritative-server-4-0-8-and-4-1-10-released/]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10163]
[https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-05.html]
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
[openSUSE-SU-2019:1773]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10164]
[FEDORA-2019-9f04a701c0]
[FEDORA-2019-e43f49b428]
[https://www.postgresql.org/about/news/1949/]
OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A user with sufficient privileges could recover OAuth tokens from these audit logs and use them to access other resources.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10165]
[https://github.com/openshift/cluster-kube-apiserver-operator/pull/499/]
[https://github.com/openshift/cluster-openshift-apiserver-operator/pull/205]
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.
[https://access.redhat.com/libvirt-privesc-vulnerabilities]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10166]
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
[https://access.redhat.com/libvirt-privesc-vulnerabilities]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10167]
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
[https://access.redhat.com/libvirt-privesc-vulnerabilities]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10168]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0960, CVE-2019-1014.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1017]
It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10171]
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
[http://x-stream.github.io/changes.html#1.4.11]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173]
A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the source namespace. This could allow users to clone any PVC in the cluster into their own namespace, effectively allowing access to other user's data.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10175]
A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack.
[RHSA-2019:2792]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10176]
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.
[109065]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177]
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1018]
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
[openSUSE-SU-2019:1911]
[http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181]
[https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327]
[https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344]
[[debian-lts-announce] 20190909 [SECURITY] [DLA 1914-1] icedtea-web security update]
[20191007 CVE-2019-10181, CVE-2019-10182, CVE-2019-10185: IcedTea-Web vulnerabilities leading to RCE]
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.
[openSUSE-SU-2019:1911]
[http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182]
[https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327]
[https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344]
[[debian-lts-announce] 20190909 [SECURITY] [DLA 1914-1] icedtea-web security update]
[20191007 CVE-2019-10181, CVE-2019-10182, CVE-2019-10185: IcedTea-Web vulnerabilities leading to RCE]
Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.
[109027]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10183]
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
[RHSA-2019:2935]
[RHSA-2019:2936]
[RHSA-2019:2937]
[RHSA-2019:2938]
[RHSA-2019:2998]
[RHSA-2019:3044]
[RHSA-2019:3045]
[RHSA-2019:3046]
[RHSA-2019:3050]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184]
[https://github.com/undertow-io/undertow/pull/794]
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
[openSUSE-SU-2019:1911]
[http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10185]
[https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327]
[https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344]
[[debian-lts-announce] 20190909 [SECURITY] [DLA 1914-1] icedtea-web security update]
[20191007 CVE-2019-10181, CVE-2019-10182, CVE-2019-10185: IcedTea-Web vulnerabilities leading to RCE]
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.
[109175]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10186]
[https://moodle.org/mod/forum/discuss.php?d=388567#p1566329]
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.
[109174]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187]
[https://moodle.org/mod/forum/discuss.php?d=388568#p1566330]
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.
[109178]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10188]
[https://moodle.org/mod/forum/discuss.php?d=388569]
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment.
[109271]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10189]
[https://moodle.org/mod/forum/discuss.php?d=388570]
A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'.
[http://packetstormsecurity.com/files/153639/Microsoft-Windows-HTTP-To-SMB-NTLM-Reflection-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1019]
A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10190]
[FEDORA-2019-20f95b0b39]
[FEDORA-2019-fdb50c675d]
[https://www.knot-resolver.cz/2019-07-10-knot-resolver-4.1.0.html]
A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10191]
[FEDORA-2019-20f95b0b39]
[FEDORA-2019-fdb50c675d]
[https://www.knot-resolver.cz/2019-07-10-knot-resolver-4.1.0.html]
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
[109290]
[RHSA-2019:1819]
[RHSA-2019:1860]
[RHSA-2019:2002]
[RHSA-2019:2506]
[RHSA-2019:2508]
[RHSA-2019:2621]
[RHSA-2019:2630]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10192]
[https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES]
[https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES]
[https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES]
[20190712 [SECURITY] [DSA 4480-1] redis security update]
[GLSA-201908-04]
[USN-4061-1]
[DSA-4480]
A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.
[109290]
[RHSA-2019:1819]
[RHSA-2019:2002]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10193]
[https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES]
[https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES]
[https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES]
[20190712 [SECURITY] [DSA 4480-1] redis security update]
[GLSA-201908-04]
[USN-4061-1]
[DSA-4480]
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.
[109140]
[RHSA-2019:2499]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10194]
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.
[openSUSE-SU-2019:2142]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197]
[FEDORA-2019-eb1e982800]
[FEDORA-2019-e3e521e5b3]
[FEDORA-2019-41c7fa478a]
[20190904 [SECURITY] [DSA 4513-1] samba security update]
[https://security.netapp.com/advisory/ntap-20190903-0001/]
[https://support.f5.com/csp/article/K69511801]
[https://support.f5.com/csp/article/K69511801?utm_source=f5support&utm_medium=RSS]
[USN-4121-1]
[DSA-4513]
[https://www.samba.org/samba/security/CVE-2019-10197.html]
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10198]
[https://projects.theforeman.org/issues/27275]
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10199]
yard before 0.9.20 allows path traversal.
[https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr]
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
[https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8]
invenio-records before 1.2.2 allows XSS.
[https://github.com/inveniosoftware/invenio-records/security/advisories/GHSA-vxh3-mvv7-265j]
Tridactyl before 1.16.0 allows fake key events.
[https://github.com/tridactyl/tridactyl/security/advisories/GHSA-7qr7-93pf-hr8f]
invenio-communities before 1.0.0a20 allows XSS.
[https://github.com/inveniosoftware/invenio-communities/security/advisories/GHSA-mfv8-q39f-mgfg]
invenio-app before 1.1.1 allows host header injection.
[https://github.com/inveniosoftware/invenio-app/security/advisories/GHSA-94mf-xfg5-r247]
Dependency-Track before 3.5.1 allows XSS.
[https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-jp9v-w6vw-9m5v]
stacktable.js before 1.0.4 allows XSS.
[https://github.com/WebFirst/stacktable.js/security/advisories/GHSA-r9j3-hgxr-75xg]
Fleet before 2.1.2 allows exposure of SMTP credentials.
[https://github.com/kolide/fleet/security/advisories/GHSA-6g7f-8qm4-f7h8]
Misskey before 10.102.4 allows hijacking a user's token.
[https://github.com/syuilo/misskey/security/advisories/GHSA-6qw9-6jxq-xj3p]
SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.
[https://github.com/Charcoal-SE/SmokeDetector/security/advisories/GHSA-5w85-7mwr-v44q]
parse-server before 3.4.1 allows DoS after any POST to a volatile class.
[https://github.com/parse-community/parse-server/security/advisories/GHSA-2479-qvv7-47qq]
parse-server before 3.6.0 allows account enumeration.
[https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5]
docker-credential-helpers before 0.6.3 has a double free in the List functions.
[https://github.com/docker/docker-credential-helpers/commit/1c9f7ede70a5ab9851f4c9cb37d317fd89cd318a]
[https://github.com/docker/docker-credential-helpers/releases/tag/v0.6.3]
[USN-4103-1]
[USN-4103-2]
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
[https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac]
ASH-AIO before 2.0.0.3 allows an open redirect.
[https://github.com/ASHTeam/ash-aio-2/security/advisories/GHSA-cg3m-qj5v-8g48]
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.
[https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a]
[https://github.com/discourse/discourse/commit/e6e47f2fb22764c92aaa90445c7bf203192fba11]
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.
[https://github.com/discourse/discourse/commit/52387be4a44cdeaca5421ee955ba1343e836bade]
[https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a]
invenio-previewer before 1.0.0a12 allows XSS.
[https://github.com/inveniosoftware/invenio-previewer/security/advisories/GHSA-j9m2-6hq2-4r3c]
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10201]
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10202]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007, CVE-2019-1022, CVE-2019-1026, CVE-2019-1027, CVE-2019-1028.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1021]
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
[RHSA-2019:2998]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212]
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10215]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007, CVE-2019-1021, CVE-2019-1026, CVE-2019-1027, CVE-2019-1028.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1022]
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI.
[http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html]
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0990.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1023]
Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword() (inc/auth.class.php).
[https://github.com/glpi-project/glpi/pull/5520]
[https://github.com/glpi-project/glpi/releases/tag/9.4.1.1]
Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.
[https://github.com/glpi-project/glpi/commit/684d4fc423652ec7dde21cac4d41c2df53f56b3c]
Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
[https://github.com/glpi-project/glpi/pull/5562]
[https://github.com/glpi-project/glpi/releases/tag/9.4.1.1]
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040.
[http://www.iwantacve.cn/index.php/archives/172/]
Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.
[http://www.iwantacve.cn/index.php/archives/175/]
Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user context) to obtain cleartext credentials of the stored account.
[https://blog.to.com/advisory-runasspc-cve-2019-10239/]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1051, CVE-2019-1052.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1024]
Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053]
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=546121]
[[kafka-jira] 20190503 [jira] [Resolved] (KAFKA-8308) Update jetty for security vulnerability CVE-2019-10241]
[[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar]
[[kafka-jira] 20190501 [jira] [Created] (KAFKA-8308) Update jetty for security vulnerability CVE-2019-10241]
[[kafka-dev] 20190503 [jira] [Resolved] (KAFKA-8308) Update jetty for security vulnerability CVE-2019-10241]
[[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.]
[[kafka-jira] 20190503 [jira] [Assigned] (KAFKA-8308) Update jetty for security vulnerability CVE-2019-10241]
[[kafka-dev] 20190501 [jira] [Created] (KAFKA-8308) Update jetty for security vulnerability CVE-2019-10241]
[https://security.netapp.com/advisory/ntap-20190509-0003/]
In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
[107844]
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835]
In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifically craft attacks to the web server run by Kura.
[107844]
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=545834]
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.
[107844]
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835]
In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.
[108094]
[RHSA-2019:1163]
[RHSA-2019:1164]
[RHSA-2019:1165]
[RHSA-2019:1166]
[RHSA-2019:1238]
[RHSA-2019:1325]
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=545588]
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576]
[https://security.netapp.com/advisory/ntap-20190509-0003/]
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=546577]
[[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar]
[[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.]
[https://security.netapp.com/advisory/ntap-20190509-0003/]
Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622]
All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996]
[https://github.com/eclipse/xtext-xtend/issues/759]
A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1025]
UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.
[https://www.bleepingcomputer.com/news/security/uc-browser-for-android-desktop-exposes-500-million-users-to-mitm-attacks/]
The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files (related to libpicsel), which allows MITM attacks.
[https://news.drweb.com/show/?i=13176&c=38]
[https://www.bleepingcomputer.com/news/security/uc-browser-for-android-desktop-exposes-500-million-users-to-mitm-attacks/]
A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request.
[http://packetstormsecurity.com/files/154294/Wolters-Kluwer-TeamMate-3.1-Cross-Site-Request-Forgery.html]
[http://www.teammatesolutions.com/]
In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
[https://github.com/MISP/MISP/commit/586cca384be6710b03e14bcbeb7588c1772604ec]
[https://github.com/MISP/MISP/compare/f493659...0e4f66e]
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
[https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4]
[https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb]
[https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b]
[https://github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed]
[https://github.com/jupyter/notebook/compare/05aa4b2...16cf97c]
[FEDORA-2019-a6e1287e76]
[FEDORA-2019-9e67979b2a]
An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.
[http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2019-001-v1.pdf]
[https://www.vivotek.com/cybersecurity]
Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation) to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java sources from /WEB-INF/classes/*.class
[http://www.sk-it.com/en/cve.html]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007, CVE-2019-1021, CVE-2019-1022, CVE-2019-1027, CVE-2019-1028.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1026]
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
[https://github.com/totaljs/cms/commit/75205f93009db3cf8c0b0f4f1fc8ab82d70da8ad]
[https://github.com/totaljs/cms/commit/8b9d7dada998c08d172481d9f0fc0397c4b3c78d]
CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action.
[107769]
[https://packetstormsecurity.com/files/152303/CentOS-Web-Panel-0.9.8.789-Cross-Site-Scripting.html]
[46629]
A SQL Injection issue was discovered in BlueCMS 1.6. The variable $ad_id is spliced directly in uploads/admin/ad.php in the admin folder, and is not wrapped in single quotes, resulting in injection around the escape of magic quotes.
[https://github.com/8test/pentest/issues/2]
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account.
[https://www.wbsec.nl/ahsay/]
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE.
[https://www.wbsec.nl/ahsay/]
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to (for example) "C:" then one can browse the whole server.
[https://www.wbsec.nl/ahsay/]
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication.
[http://packetstormsecurity.com/files/153772/Ahsay-Backup-7.x-8.x-XML-Injection.html]
[https://www.wbsec.nl/ahsay/]
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator).
[http://packetstormsecurity.com/files/153770/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html]
[http://packetstormsecurity.com/files/153771/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html]
[https://www.wbsec.nl/ahsay/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.
[https://coreymhudson.github.io/bwa_vulnerabilties/]
[https://github.com/lh3/bwa/pull/232]
[USN-4087-1]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007, CVE-2019-1021, CVE-2019-1022, CVE-2019-1026, CVE-2019-1028.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1027]
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.
[https://cxsecurity.com/issue/WLB-2019060101]
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.
[https://cxsecurity.com/issue/WLB-2019060120]
An issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the /workflow/request/ViewRequestForwardSPA.jsp isintervenor parameter, as demonstrated by the %0aSet-cookie: substring.
[https://expzh.com/Weaver-e-cology9.0-CRLF-Injection.pdf]
[https://www.weaver.com.cn/cs/securityDownload.asp]
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account.
[http://packetstormsecurity.com/files/152439/ManageEngine-ServiceDesk-Plus-9.3-User-Enumeration.html]
[https://0x445.github.io/CVE-2019-10273/]
[46674]
Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type.
[https://github.com/cobub/razor/issues/168]
[https://github.com/kyrie403/Vuln/blob/master/Cobub%20Razor/Cobub%20Razor%20-%20file%20upload%20vulnerability.md]
Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1085]
A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1091]
A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1091]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007, CVE-2019-1021, CVE-2019-1022, CVE-2019-1026, CVE-2019-1027.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1028]
Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1093]
Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-828]
Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-843]
Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-946]
Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-947]
Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-955]
Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-959]
Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-963]
Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1031]
A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1032]
A denial of service vulnerability exists in Skype for Business, aka 'Skype for Business and Lync Server Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1029]
A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1032]
Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1040]
A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1055]
A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1055]
Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1056]
Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1063]
Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1066]
Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1090]
Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1092]
Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins]
[107790]
[https://jenkins.io/security/advisory/2019-04-03/#SECURITY-960]
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1030]
A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[108045]
[https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357]
[https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0788]
A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[108045]
[https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357]
Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
[108045]
[https://jenkins.io/security/advisory/2019-04-17/#SECURITY-836]
Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.
[108045]
[https://jenkins.io/security/advisory/2019-04-17/#SECURITY-844]
A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers to initiate a connection to an attacker-specified server.
[108045]
[https://jenkins.io/security/advisory/2019-04-17/#SECURITY-983]
A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
[108045]
[https://jenkins.io/security/advisory/2019-04-17/#SECURITY-983]
A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM.
[108045]
[https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1341]
A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1100]
A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all users.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1100]
Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252]
[https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-1032, CVE-2019-1033, CVE-2019-1036.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1031]
A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355]
[https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0786]
A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355]
A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355]
Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1143]
Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-936]
Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-443]
Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1380]
Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-930]
Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.
[[oss-security] 20190430 Multiple vulnerabilities in Jenkins plugins]
[108159]
[https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390]
A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as.
[[oss-security] 20190521 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1316]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-1031, CVE-2019-1033, CVE-2019-1036.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1032]
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
[20190524 Exploring the File System via Jenkins Credentials Plugin Vulnerability - CVE-2019-10320]
[[oss-security] 20190521 Multiple vulnerabilities in Jenkins plugins]
[108462]
[RHBA-2019:1605]
[RHSA-2019:1636]
[https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322]
[https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/]
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20(1)]
[https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787]
A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20(1)]
[https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787]
A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20(2)]
[https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0846]
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1347]
A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1373]
A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1391]
An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1409]
Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[RHBA-2019:1605]
[RHSA-2019:1636]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-921]
Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1403]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-1031, CVE-2019-1032, CVE-2019-1036.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1033]
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
[[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins]
[108540]
[https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046]
A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to an attacker-specified URL using attacker-specified credentials.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20(1)]
A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20(1)]
Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20(2)]
Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1411]
A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1412]
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420]
An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[RHSA-2019:1636]
[RHSA-2019:1851]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399]
A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1379]
A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.
[[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins]
[108747]
[https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1379]
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1035.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1034]
A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1010]
A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1010]
A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1400]
Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being applied.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1279]
Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1290]
Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1303]
A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1419]
Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-775]
Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1438]
[https://www.zerodayinitiative.com/advisories/ZDI-19-837/]
A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
[http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.html]
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177]
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1034.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1035]
[https://www.zerodayinitiative.com/advisories/ZDI-19-572/]
Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1441]
[https://www.zerodayinitiative.com/advisories/ZDI-19-838/]
Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins]
[109156]
[https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1437]
[https://www.zerodayinitiative.com/advisories/ZDI-19-836/]
A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
[[oss-security] 20190717 Multiple vulnerabilities in Jenkins]
[109299]
[RHSA-2019:2503]
[RHSA-2019:2548]
[https://jenkins.io/security/advisory/2019-07-17/#SECURITY-1424]
[https://www.tenable.com/security/research/tra-2019-35]
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
[[oss-security] 20190717 Multiple vulnerabilities in Jenkins]
[109373]
[RHSA-2019:2503]
[RHSA-2019:2548]
[https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626]
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
[[oss-security] 20190717 Multiple vulnerabilities in Jenkins]
[109373]
[RHSA-2019:2503]
[RHSA-2019:2548]
[https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534]
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[RHSA-2019:2594]
[RHSA-2019:2651]
[RHSA-2019:2662]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(1)]
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[RHSA-2019:2594]
[RHSA-2019:2651]
[RHSA-2019:2662]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(2)]
A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[RHSA-2019:2594]
[RHSA-2019:2651]
[RHSA-2019:2662]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY1422]
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-713]
A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perform releases with attacker-specified options.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1098]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-1031, CVE-2019-1032, CVE-2019-1033.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1036]
A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1184]
Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435]
[https://www.zerodayinitiative.com/advisories/ZDI-19-835/]
Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446]
Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1458]
Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-673]
Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1345]
Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1429]
[https://www.zerodayinitiative.com/advisories/ZDI-19-833/]
Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging the configuration being applied.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1497]
A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482]
A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482]
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1037]
Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-157]
A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-795]
An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796]
A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-879]
A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-142]
An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-569]
A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-751]
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1099]
Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1428]
[https://www.zerodayinitiative.com/advisories/ZDI-19-839/]
Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-591]
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1038]
Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922]
Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-931]
Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1376]
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
[[oss-security] 20190828 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[RHSA-2019:2789]
[https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1453]
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
[[oss-security] 20190828 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[RHSA-2019:2789]
[https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491]
Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1430]
[https://www.zerodayinitiative.com/advisories/ZDI-19-834/]
A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1008]
A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1008]
A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1053]
A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server.
[[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1053]
An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated attacker could run a specially crafted application, aka 'Windows Kernel Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1039]
A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
[[oss-security] 20190828 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1294]
Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
[[oss-security] 20190828 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1512]
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1534]
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538]
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538]
Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1476]
Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1489]
Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURTY-1509]
Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1545]
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538]
A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1040]
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.
[[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538]
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1498]
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1525]
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1537%20(1)]
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1537%20(2)]
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505]
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1471]
Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-351]
A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templates.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-401]
A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger project generation from templates.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-401]
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1065.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1041]
Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-732]
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1513]
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1514]
Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1557]
Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1574]
Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1577]
Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1577]
Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-920%20(1)]
Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-920%20(2)]
Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURTIY-1541]
Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1543]
Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1544]
Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1548]
Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1551]
Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1561]
Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1572]
Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1573]
Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1507]
Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1508]
Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1575]
A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1043]
Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
[[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins]
[https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504]
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
[[oss-security] 20191001 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579]
Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those.
[[oss-security] 20191001 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1590]
Jenkins Dingding[??] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
[[oss-security] 20191001 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1423]
[https://www.zerodayinitiative.com/advisories/ZDI-19-862/]
Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
[[oss-security] 20191001 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515]
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
[[oss-security] 20191001 Multiple vulnerabilities in Jenkins plugins]
[https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1524]
A security feature bypass vulnerability exists when Windows Secure Kernel Mode fails to properly handle objects in memory.To exploit the vulnerability, a locally-authenticated attacker could attempt to run a specially crafted application on a targeted system, aka 'Windows Secure Kernel Mode Security Feature Bypass Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1044]
An elevation of privilege vulnerability exists in the way that the Windows Network File System (NFS) handles objects in memory, aka 'Windows Network File System Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1045]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1046]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1047]
The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions.
[https://github.com/fusioninventory/fusioninventory-for-glpi/commit/0f777f85773b18f5252e79afa1929fcdc4858c3a]
[https://github.com/fusioninventory/fusioninventory-for-glpi/compare/260a864...e1f776d]
[https://github.com/fusioninventory/fusioninventory-for-glpi/compare/cec774a...baa4158]
[https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.3%2B1.4]
[https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.4%2B1.1]
An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. An unrestricted file upload vulnerability in the Front Circle Controller glytoolcgi/settingfile_upload.cgi allows attackers to upload supplied data. This can be used to place attacker controlled code on the filesystem that can be executed and can lead to a reverse root shell.
[https://github.com/warringaa/CVEs#glory-systems-rbw-100]
An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacker to gain admin access to the Front Circle Controller web interface.
[https://github.com/warringaa/CVEs#glory-systems-rbw-100]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1049, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1048]
Possible null-pointer dereference can occur while parsing avi clip during copy in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
[https://www.qualcomm.com/company/product-security/bulletins]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1050.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1049]
Boot image not getting verified by AVB in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 820, SD 820A, SDM439
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
Use after free issue occurs If another instance of open for voice_svc node has been called from application without closing the previous one. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
Buffer overflow scenario if the client sends more than 5 io_vec requests to the server in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
[https://www.qualcomm.com/company/product-security/bulletins]
Improper validation of read and write index of tx and rx fifo`s before using for data copy from fifo can lead to out-of-bound access. in Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, QCS405, SD 665, SD 675, SD 730, SD 855
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1050]
Possible use after free issue due to improper input validation in volume listener library in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
While processing QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY vendor command, driver does not validate the data obtained from the user space which could be invalid and thus leads to an undesired behaviour in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
Lack of check of extscan change results received from firmware can lead to an out of buffer read in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 210/SD 212/SD 205, SD 425, SD 430, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
Lack of input validation for data received from user space can lead to OOB access in WLAN in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 650/52, SD 820A, SDX20
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
Device record of the pairing device used after free during ACL disconnection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1052.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1051]
BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 675, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1052]
An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts, aka 'Windows Shell Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1053]
Lack of check of address range received from firmware response allows modem to respond arbitrary pages into its address range which can compromise HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM660, SDX20, SDX24
[https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin]
Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA8081, QCA9379, QCS404, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SXR1130
[https://www.qualcomm.com/company/product-security/bulletins]
A security feature bypass vulnerability exists in Edge that allows for bypassing Mark of the Web Tagging (MOTW), aka 'Microsoft Edge Security Feature Bypass Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1054]
Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, MSM8996AU, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCS404, QCS405, QCS605, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SXR1130
[https://www.qualcomm.com/company/product-security/bulletins]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0920, CVE-2019-0988, CVE-2019-1005, CVE-2019-1080.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1055]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1001, CVE-2019-1004, CVE-2019-1059.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1056]
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1057]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1001, CVE-2019-1004, CVE-2019-1056.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1059]
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1060]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1092, CVE-2019-1103, CVE-2019-1106, CVE-2019-1107.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1062]
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1063]
A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device.
[http://maxwelldulin.com/BlogPost?post=3236967424]
Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.
[http://maxwelldulin.com/BlogPost?post=3236967424]
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files.
[http://maxwelldulin.com/BlogPost?post=3236967424]
An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs.
[http://maxwelldulin.com/BlogPost?post=3236967424]
An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields.
[http://maxwelldulin.com/BlogPost?post=3236967424]
Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1087, 88SS1090, 88SS1100, 88SS1084, 88SS1088, & 88SS1098) devices allow reprogramming flash memory to bypass the secure boot protection mechanism.
[https://www.marvell.com/documents/x9g4hrszt5ls3udbe1eo/]
Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1087, 88SS1090, 88SS1100, 88SS1084, 88SS1088, & 88SS1098) devices are vulnerable in manipulating a combination of IO pins to bypass the secure boot protection mechanism.
[https://www.marvell.com/documents/x9g4hrszt5ls3udbe1eo/]
In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.
[openSUSE-SU-2019:1716]
[openSUSE-SU-2019:1757]
[109092]
[https://arxiv.org/pdf/1906.10478.pdf]
[https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8]
[https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.7]
[https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=355b98553789b646ed97ad801a619ff898471b92]
[https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=df453700e8d81b1bdafdf684365ee2b9431fb702]
[https://github.com/torvalds/linux/commit/355b98553789b646ed97ad801a619ff898471b92]
[https://github.com/torvalds/linux/commit/55f0fc7a02de8f12757f4937143d8d5091b2e40b]
[https://github.com/torvalds/linux/commit/df453700e8d81b1bdafdf684365ee2b9431fb702]
[[debian-lts-announce] 20190814 [SECURITY] [DLA 1884-1] linux security update]
[[debian-lts-announce] 20190814 [SECURITY] [DLA 1885-1] linux-4.9 security update]
[20190812 [SECURITY] [DSA 4495-1] linux security update]
[20190813 [SECURITY] [DSA 4497-1] linux security update]
[https://security.netapp.com/advisory/ntap-20190806-0001/]
[USN-4114-1]
[USN-4115-1]
[USN-4116-1]
[USN-4117-1]
[USN-4118-1]
[DSA-4495]
[DSA-4497]
The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.
[openSUSE-SU-2019:1716]
[openSUSE-SU-2019:1757]
[https://arxiv.org/pdf/1906.10478.pdf]
[https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8]
[https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=355b98553789b646ed97ad801a619ff898471b92]
[https://github.com/torvalds/linux/commit/355b98553789b646ed97ad801a619ff898471b92]
[[debian-lts-announce] 20190723 [SECURITY] [DLA 1862-1] linux security update]
[[debian-lts-announce] 20190814 [SECURITY] [DLA 1885-1] linux-4.9 security update]
[20190813 [SECURITY] [DSA 4497-1] linux security update]
[https://security.netapp.com/advisory/ntap-20190806-0001/]
[https://support.f5.com/csp/article/K32804955]
[https://support.f5.com/csp/article/K32804955?utm_source=f5support&utm_medium=RSS]
[USN-4115-1]
[USN-4118-1]
[DSA-4497]
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1064]
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption.
[https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/]
[https://about.gitlab.com/blog/categories/releases/]
[https://gitlab.com/gitlab-org/gitlab-ce/issues/49665]
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
[https://contao.org/en/news.html]
[https://contao.org/en/news/security-vulnerability-cve-2019-10641.html]
Contao 4.7 allows CSRF.
[https://contao.org/en/news.html]
[https://contao.org/en/news/security-vulnerability-cve-2019-10642.html]
Contao 4.7 allows Use of a Key Past its Expiration Date.
[https://contao.org/en/news.html]
[https://contao.org/en/news/security-vulnerability-cve-2019-10643.html]
An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account.
[https://github.com/hyyyp/HYBBS2/issues/3]
Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded.
[https://github.com/wolfcms/wolfcms/issues/682]
ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file).
[https://github.com/kyrie403/Vuln/blob/master/zzzcms/zzzphp%20v1.6.3%20write%20file%20with%20dangerous%20type.md]
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
[https://github.com/robo-code/robocode/commit/836c84635e982e74f2f2771b2c8640c3a34221bd#diff-0296a8f9d4a509789f4dc4f052d9c36f]
[https://sourceforge.net/p/robocode/bugs/406/]
In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.
[107645]
[https://github.com/ImageMagick/ImageMagick/issues/1533]
[USN-4034-1]
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1041.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1065]
[https://www.zerodayinitiative.com/advisories/ZDI-19-571/]
In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.
[openSUSE-SU-2019:1320]
[openSUSE-SU-2019:1331]
[107646]
[https://github.com/ImageMagick/ImageMagick/issues/1532]
[[debian-lts-announce] 20190514 [SECURITY] [DLA 1785-1] imagemagick security update]
[20190429 [SECURITY] [DSA 4436-1] imagemagick security update]
[USN-4034-1]
[DSA-4436]
An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code execution. In other words, the issue affects 2017.3, 2018.1, and 2018.3 installations that lack the April 2019 update.
[https://forums.ivanti.com/s/article/Security-Alert-Ivanti-Endpoint-Manager-April-2019]
An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature.
[https://github.com/flatCore/flatCore-CMS/issues/38]
An issue was discovered in Hsycms V1.1. There is a SQL injection vulnerability via a /news/*.html page.
[https://www.cnblogs.com/7bit/articles/10551499.html]
The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive, a different vulnerability than CVE-2017-8845.
[https://github.com/ckolivas/lrzip/issues/108]
Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication. This can be exploited remotely or via CSRF because the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd.
[https://github.com/scarvell/grandstream_exploits]
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply update_nds_webroot_from_tmp API call.
[https://github.com/scarvell/grandstream_exploits]
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config request.
[https://github.com/scarvell/grandstream_exploits]
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/controller.icc.update_nds_webroot_from_tmp update_nds_webroot_from_tmp API call.
[https://github.com/scarvell/grandstream_exploits]
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field.
[https://github.com/scarvell/grandstream_exploits]
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field.
[https://github.com/scarvell/grandstream_exploits]
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
On Grandstream GXV3611IR_HD before 1.0.3.23 devices, the root account lacks a password.
[https://github.com/scarvell/grandstream_exploits]
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.
[https://github.com/scarvell/grandstream_exploits]
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI.
[https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1]
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
[http://packetstormsecurity.com/files/152678/Domoticz-4.10577-Unauthenticated-Remote-Command-Execution.html]
[https://github.com/domoticz/domoticz/commit/ee70db46f81afa582c96b887b73bcd2a86feda00]
[46773]
An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
[https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023/]
An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input without sanitizing the values by calling basename() or a similar function. An attacker can leverage this to execute PHP code from the included file. Exploitation of these scripts is made difficult by additional text being appended (typically .inc.php), which means an attacker would need to be able to control both a filename and its content on the server. However, exploitation can be achieved as demonstrated by the csv.php?report=../ substring.
[https://www.darkmatter.ae/xen1thlabs/librenms-limited-local-file-inclusion-via-directory-traversal-vulnerability-xl-19-020/]
An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths.
[https://www.darkmatter.ae/xen1thlabs/librenms-information-disclosure-vulnerability-xl-19-018/]
An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.
[https://www.darkmatter.ae/xen1thlabs/librenms-authentication-bypass-vulnerability-xl-19-016/]
An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function. This function is not the appropriate function to sanitize command arguments as it does not escape a number of command line syntax characters such as ` (backtick), allowing an attacker to inject commands into the variable $rrd_cmd, which gets executed via passthru().
[http://packetstormsecurity.com/files/154391/LibreNMS-Collectd-Command-Injection.html]
[https://www.darkmatter.ae/xen1thlabs/librenms-command-injection-vulnerability-xl-19-017/]
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1067]
An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these contexts, leading to attacker controlled JavaScript executing in the browser. One example of this is the string parameter in html/pages/inventory.inc.php.
[https://www.darkmatter.ae/xen1thlabs/librenms-multiple-reflected-cross-site-scripting-vulnerability-xl-19-021/]
An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
[https://www.darkmatter.ae/xen1thlabs/librenms-multiple-sql-injection-vulnerability-xl-19-025/]
treeRead in hdf/btree.c in libmysofa before 0.7 does not properly validate multiplications and additions.
[https://github.com/hoene/libmysofa/commit/d39a171e9c6a1c44dbdf43f9db6c3fbd887e38c1]
[https://github.com/hoene/libmysofa/compare/49aa1c7...2ed84bb]
[https://github.com/hoene/libmysofa/releases/tag/v0.7]
[USN-4033-1]
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.
[http://packetstormsecurity.com/files/152315/WordPress-Ultimate-Member-2.0.38-Cross-Site-Request-Forgery.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window will appear prompting the user if they want to save this new password. This pop-up window will persist on any page the user enters within the browser until a decision is made. The code of the pop-up window can be read by remote servers and contains the login credentials and URL in cleartext. A malicious server could easily grab this information from the pop-up. This is related to id="uniqkey-password-popup" and password-popup/popup.html.
[https://cxsecurity.com/issue/WLB-2019040055]
[https://packetstormsecurity.com/files/152410/Uniqkey-Password-Manager-1.14-Credential-Disclosure.html]
[https://seclists.org/fulldisclosure/2019/Apr/1]
[https://vuldb.com/?id.132740]
Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg).
[http://packetstormsecurity.com/files/154357/DASAN-Zhone-ZNID-GPON-2426A-EU-Cross-Site-Scripting.html]
[https://adamziaja.com/poc/201903-xss-zhone.html]
[https://blog.redteam.pl/2019/09/cve-2019-10677-dasan-zhone-znid.html]
[https://redteam.pl/poc/dasan-zhone-znid-gpon-2426a-eu.html]
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
[http://packetstormsecurity.com/files/152678/Domoticz-4.10577-Unauthenticated-Remote-Command-Execution.html]
[https://github.com/domoticz/domoticz/commit/2119afbe74ee0c914c1d5c4c859c594c08b0ad42]
[46773]
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068]
Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index.php?m=Admin&c=config&a=edit site_domain parameter.
[https://github.com/kyrie403/Vuln/blob/master/74cms/74cms%20v5.0.1%20remote%20code%20execution.md]
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Heidelberg Prinect Archiver v2013 release 1.0.
[https://github.com/alt3kx/CVE-2019-10685]
[https://medium.com/@alt3kx/a-reflected-xss-in-print-archive-system-v2015-release-2-6-cve-2019-10685-b60763b7768b]
An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.
[https://github.com/ctripcorp/apollo/issues/2103]
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
[http://packetstormsecurity.com/files/154184/KBPublisher-6.0.2.1-SQL-Injection.html]
[https://github.com/pandujar/advisories/blob/master/KBPublisher_6.0.2.1_en.txt]
VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded credentials to establish connections between the host application and the device.
[https://support.polycom.com/content/dam/polycom-support/global/documentation/hard-coded-credentials-vulnerability-in-vvx-products.pdf]
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.
[108799]
[https://support.polycom.com/content/dam/polycom-support/global/documentation/insufficient-authentication-leakage-vvx-products.pdf]
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations, aka 'Task Scheduler Elevation of Privilege Vulnerability'.
[https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069]
[VU#119704]
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username.
[openSUSE-SU-2019:1312]
[[oss-security] 20190418 CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.]
[[dovecot-news] 20190418 CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.]
[FEDORA-2019-1b61a528dd]
[GLSA-201908-29]
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
[http://www.rapid7.com/db/modules/auxiliary/admin/http/wp_google_maps_sqli]
[https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755]
[https://wordpress.org/plugins/wp-google-maps/#developers]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1070]
MKCMS V5.0 has SQL injection via the bplay.php play parameter.
[http://www.iwantacve.cn/index.php/archives/181/]
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
[http://www.iwantacve.cn/index.php/archives/185/]
AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potentially privilege escalation via a crafted DeviceIoControl call.
[http://packetstormsecurity.com/files/154259/Asus-Precision-TouchPad-11.0.0.25-Denial-Of-Service-Privilege-Escalation.html]
[https://blog.telspace.co.za/2019/08/tsa-2019-001-asus-precision-touchpad.html]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1073.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1071]
Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc.
[https://dojo.bullguard.com/dojo-by-bullguard/blog/cam-hi-risk/]
Incorrect access control in the RTSP stream and web portal on all IP cameras based on Hisilicon Hi3510 firmware (until Webware version V1.0.1) allows attackers to view an RTSP stream by connecting to the stream with hidden credentials (guest or user) that are neither displayed nor configurable in the camera's CamHi or keye mobile management application. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc.
[https://dojo.bullguard.com/dojo-by-bullguard/blog/cam-hi-risk/]
The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-830, 750-849, 750-871, 750-872, 750-873) devices has undocumented service access.
[108482]
[https://cert.vde.com/de-de/advisories/vde-2019-008]
LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
[https://github.com/ImageMagick/ImageMagick/commit/07eebcd72f45c8fd7563d3f9ec5d2bed48f65f36]
[https://github.com/ImageMagick/ImageMagick/commit/58d9c46929ca0828edde34d263700c3a5fe8dc3c]
[https://github.com/ImageMagick/ImageMagick/commit/edc7d3035883ddca8413e4fe7689aa2e579ef04a]
[https://github.com/ImageMagick/ImageMagick/issues/1495]
BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
[20190624 BlogEngine.NET 3.3.7 and earlier Directory Traversal + Listing]
[https://github.com/rxtur/BlogEngine.NET/commits/master]
[https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect]
BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.
[http://packetstormsecurity.com/files/153364/BlogEngine.NET-3.3.6-3.3.7-XML-Injection.html]
[https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks]
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
[http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html]
[20190618 BlogEngine.NET Directory traversal + RCE]
[https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720]
A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072]
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
[http://packetstormsecurity.com/files/153348/BlogEngine.NET-3.3.6-3.3.7-Theme-Cookie-Directory-Traversal-Remote-Code-Execution.html]
[20190618 BlogEngine.NET Directory traversal + RCE]
[https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720]
BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx.
[https://github.com/rxtur/BlogEngine.NET/commits/master]
[https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect]
An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated.
[https://sourceforge.net/p/podofo/tickets/46/]
There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher privilege. The following are affected products and versions: Legion Y520T_Z370 6.0.1.8642, AIO310-20IAP 6.0.1.8642, AIO510-22ISH 6.0.1.8642, AIO510-23ISH 6.0.1.8642, AIO520-22IKL 6.0.1.8642, AIO520-22IKU 6.0.1.8642, AIO520-24IKL 6.0.1.8642, AIO520-24IKU 6.0.1.8642, AIO520-27IKL 6.0.1.8642, AIO720-24IKB 6.0.1.8642, IdeaCentre 520S-23IKU 6.0.1.8642, ThinkCentre M700z 6.0.1.8642, ThinkCentre M800z 6.0.1.8642, ThinkCentre M810z 6.0.1.8642, ThinkCentre M818z 6.0.1.8642, ThinkCentre M900Z 6.0.1.8642, ThinkCentre M910z 6.0.1.8642, V410z(YT S4250) 6.0.1.8642, 330-14IKBR Win10:6.0.1.8652, 330-15IKBR Win10:6.0.1.8652, 330-15IKBR (Brazil) Win10:6.0.1.8652, 330-15IKBR Touch Win10:6.0.1.8652, 330-17IKBR Win10:6.0.1.8652, YOGA 730-13IKB Win10:6.0.1.8644, YOGA 730-15IKB Win10:6.0.1.8644, ThinkPad L560 6.0.1.8644 and 6.0.1.8652, ThinkPad L570 6.0.1.8644 and 6.0.1.8652, ThinkPad P50 6.0.1.8642, ThinkPad P50s 6.0.1.8642, ThinkPad P51s (20Jx, 20Kx) 6.0.1.8642, ThinkPad P51s (20Hx) 6.0.1.8642, ThinkPad P52s 6.0.1.8642, ThinkPad P70 6.0.1.8642, ThinkPad T25 6.0.1.8642, ThinkPad T460s 6.0.1.8642, ThinkPad T470 6.0.1.8642, ThinkPad T470s 6.0.1.8642, ThinkPad T480 6.0.1.8642, ThinkPad T480s 6.0.1.8642, ThinkPad T560 6.0.1.8642, ThinkPad T570 6.0.1.8642, ThinkPad T580 6.0.1.8642, ThinkPad X1 Carbon 8.66.76.72 and 8.66.68.54, ThinkPad X1 Carbon 6th 6.0.1.8642, ThinkPad X1 Carbon, X1 Yoga 8.66.62.92 and 8.66.62.54, ThinkPad X1 Tablet (20Gx) 6.0.1.8642, ThinkPad X1 Tablet (20Jx) 6.0.1.8642, ThinkPad X1 Tablet Gen 3 6.0.1.8642, ThinkPad X1 Yoga (20Jx) 8.66.88.60, ThinkPad X1 Yoga 3rd 6.0.1.8642, ThinkPad X280 6.0.1.8642, ThinkPad Yoga 260, S1 8.66.62.92 and 8.66.62.54.
[https://lenovomobilesupport.lenovo.com/us/en/product_security/home]
[https://support.lenovo.com/us/en/solutions/LEN-26251]
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1073]
In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
[https://bugs.kde.org/show_bug.cgi?id=404698]
[[debian-lts-announce] 20190618 [SECURITY] [DLA 1825-1] kdepim security update]
In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
[https://bugs.kde.org/show_bug.cgi?id=404697]
In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
[https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4159]
An elevation of privilege vulnerability exists in Microsoft Windows where certain folders, with local service privilege, are vulnerable to symbolic link attack. An attacker who successfully exploited this vulnerability could potentially access unauthorized information. The update addresses this vulnerability by not allowing symbolic links in these scenarios., aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1082.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1074]
In Roundcube Webmail 1.3.4, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
[https://github.com/roundcube/roundcubemail/issues/6638]
[FEDORA-2019-d9c2f1ec70]
K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitally signed) reply messages. The quoted part can contain conditional statements that show completely different text if opened in a different email client. This can be abused by an attacker to obtain valid S/MIME or PGP signatures for arbitrary content to be displayed to a third party. NOTE: the vendor states "We don't plan to take any action because of this."
[https://github.com/k9mail/k-9/issues/3925]
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
[https://app.snyk.io/vuln/SNYK-JS-AXIOS-174505]
[https://github.com/axios/axios/issues/1098]
[https://github.com/axios/axios/pull/1485]
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
[RHSA-2019:3024]
[https://security.netapp.com/advisory/ntap-20191004-0005/]
[https://snyk.io/vuln/SNYK-JS-LODASH-450202]
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
[https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211]
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
[https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212]
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
[https://snyk.io/vuln/SNYK-JS-SETVALUE-450213]
A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1075]
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
[https://snyk.io/vuln/SNYK-JS-DEEPLY-451026]
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
[openSUSE-SU-2019:2050]
[openSUSE-SU-2019:2089]
[https://github.com/jakubroztocil/httpie/releases/tag/1.0.3]
[[debian-lts-announce] 20190928 [SECURITY] [DLA 1937-1] httpie security update]
[https://snyk.io/vuln/SNYK-PYTHON-HTTPIE-460107]
In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
[https://snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377]
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
[https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402]
[https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404]
[https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406]
[https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868]
[https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869]
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
[https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407]
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
[https://snyk.io/vuln/SNYK-JS-NODEREDDASHBOARD-471939]
knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
[https://snyk.io/vuln/SNYK-JS-KNEX-471962]
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1076]
An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studio Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1077]
An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka 'Microsoft Graphics Component Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1148, CVE-2019-1153.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1078]
An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1079]
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0920, CVE-2019-0988, CVE-2019-1005, CVE-2019-1055.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1080]
An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory, aka 'Microsoft Browser Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1081]
An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL, with Local Service privilege, is vulnerable to race planting a customized DLL.An attacker who successfully exploited this vulnerability could potentially elevate privilege to SYSTEM.The update addresses this vulnerability by requiring SYSTEM privileges for a certain DLL., aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1074.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1082]
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of Service Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1083]
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1084]
Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.
[http://dgb.github.io/2019/04/05/bootstrap-sass-backdoor.html]
[https://github.com/twbs/bootstrap-sass/issues/1195]
[https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/]
[https://snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which might be untrusted.
[https://github.com/sony/nnabla/issues/209]
An issue was discovered in Uniqkey Password Manager 1.14. When entering new credentials to a site that isn't registered within this product, a pop-up window will appear asking the user if they want to save these new credentials. The code of the pop-up window can be read and, to some extent, manipulated by remote servers. This pop-up window will stay on any page the user visits within the browser until a decision is made. A malicious web server can forcefully manipulate the pop-up and cause it not to appear, stopping users from securing their credentials. This vulnerability is related to id="uniqkey-password-popup" and password-popup/popup.html, but is a different vulnerability than CVE-2019-10676.
[http://packetstormsecurity.com/files/152452/Uniqkey-Password-Manager-1.14-Denial-Of-Service.html]
[20190405 Uniqkey Password Manager 1.14 - Remote Denial Of Service [CVE-2019-10845]]
[https://vuldb.com/?id.132960]
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
Computrols CBAS 18.0.0 allows Username Enumeration.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1085]
Computrols CBAS 18.0.0 has Default Credentials.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
Computrols CBAS 18.0.0 has hard-coded encryption keys.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=start_pulling&id= substring.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
Computrols CBAS 18.0.0 allows Authentication Bypass.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
Computrols CBAS 18.0.0 allows Authenticated Command Injection.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database.
[https://applied-risk.com/index.php/download_file/view/196/165]
[https://applied-risk.com/labs/advisories]
In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255.
[https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4]
[https://github.com/jupyter/notebook/compare/16cf97c...b8e30ea]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1087, CVE-2019-1088.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1086]
A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server.
[https://pentest.com.tr/exploits/TeemIp-IPAM-2-4-0-new-config-Command-Injection-Metasploit.html]
[https://www.exploit-db.com/exploits/46641]
[46641]
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
[https://github.com/wp-statistics/wp-statistics/commit/5aec0a08680f0afea387267a8d1b9fbb3379247c]
[https://medium.com/@aramburu/cve-2019-10864-wordpress-7aebc24751c4]
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
[http://seclists.org/fulldisclosure/2019/May/8]
[https://wordpress.org/plugins/form-maker/#developers]
[https://wpvulndb.com/vulnerabilities/9286]
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
[http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html]
[http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce]
[https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73]
[https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998]
[46783]
In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.
[https://discuss.tryton.org/t/security-release-for-issue8189/1262]
[https://hg.tryton.org/trytond/rev/f58bbfe0aefb]
[20190407 [SECURITY] [DSA 4426-1] tryton-server security update]
[DSA-4426]
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
[https://wpvulndb.com/vulnerabilities/9272]
[https://www.onvio.nl/nieuws/ninjaforms-vulnerability]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1086, CVE-2019-1088.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1087]
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.
[107862]
[RHSA-2019:2713]
[https://gitlab.freedesktop.org/poppler/poppler/issues/751]
[FEDORA-2019-cb2bff6d48]
[FEDORA-2019-0ea42f074e]
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.
[107862]
[https://gitlab.freedesktop.org/poppler/poppler/issues/750]
[[debian-lts-announce] 20190606 [SECURITY] [DLA 1815-1] poppler security update]
[FEDORA-2019-cb2bff6d48]
[FEDORA-2019-0ea42f074e]
[USN-4042-1]
An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.
[107862]
[https://gitlab.freedesktop.org/poppler/poppler/issues/748]
[FEDORA-2019-cb2bff6d48]
[USN-4042-1]
Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.
[http://packetstormsecurity.com/files/152429/Bolt-CMS-3.6.6-Cross-Site-Request-Forgery-Code-Execution.html]
[https://fgsec.net/from-csrf-to-rce-bolt-cms/]
[https://github.com/bolt/bolt/pull/7768/commits/91187aef36363a870d60b0a3c1bf8507af34c9e4]
[46664]
A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MIUI native browser) and Mint Browser 1.5.3 due to the way they handle the "q" query parameter. The portion of an https URL before the ?q= substring is not shown to the user.
[http://packetstormsecurity.com/files/152497/Xiaomi-Mi-Browser-Mint-Browser-URL-Spoofing.html]
[https://sec.xiaomi.com/bug/5bedef67a31ec71e]
[https://thehackernews.com/2019/04/xiaomi-browser-vulnerability.html]
[https://www.andmp.com/2019/04/xiaomi-url-spoofing-w-ssl-vulnerability.html]
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.
[[oss-security] 20190409 [OSSA-2019-002] neutron-openvswitch-agent: Unable to install new flows on compute nodes when having broken security group rules (CVE-2019-10876)]
[RHSA-2019:0879]
[RHSA-2019:0935]
[https://bugs.launchpad.net/ossa/+bug/1813007]
[https://review.openstack.org/#/q/topic:bug/1813007]
[https://security.openstack.org/ossa/OSSA-2019-002.html]
In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.
[openSUSE-SU-2019:1793]
[openSUSE-SU-2019:1999]
[https://github.com/teeworlds/teeworlds/issues/2071]
[FEDORA-2019-d29e04fa11]
In Teeworlds 0.7.2, there is a failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions in engine/shared/datafile.cpp that can lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution.
[openSUSE-SU-2019:1793]
[openSUSE-SU-2019:1999]
[https://github.com/teeworlds/teeworlds/issues/2073]
[FEDORA-2019-d29e04fa11]
In Teeworlds 0.7.2, there is an integer overflow in CDataFileReader::Open() in engine/shared/datafile.cpp that can lead to a buffer overflow and possibly remote code execution, because size-related multiplications are mishandled.
[openSUSE-SU-2019:1793]
[openSUSE-SU-2019:1999]
[https://github.com/teeworlds/teeworlds/issues/2070]
[FEDORA-2019-d29e04fa11]
An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1086, CVE-2019-1087.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1088]
Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.
[https://airbus-seclab.github.io/]
[https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf]
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from a stack based buffer overflow in "doHandshakefromServer" function. Local users can use this vulnerability to trigger a crash of the service and potentially cause additional impact on the system.
[https://airbus-seclab.github.io/advisories/netskope.html]
[https://support.netskope.com/hc/article_attachments/360033003553/Sprint_62_Release_Notes.pdf]
[https://support.netskope.com/hc/en-us/articles/360014589894-Netskope-Client]
Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection.
[https://support.citrix.com/article/CTX247737]
[https://support.citrix.com/v1/search?searchQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin]
[https://www.tenable.com/security/research]
[https://www.tenable.com/security/research/tra-2019-18]
Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vulnerability means that passwords saved for example.com will be recommended for usersite.example.com. This could lead to successful phishing campaigns and create a sense of false security.
[https://vuldb.com/?id.133069]
An issue was discovered in Ivanti Workspace Control before 10.3.90.0. Local authenticated users with low privileges in a Workspace Control managed session can bypass Workspace Control security features configured for this session by resetting the session context.
[https://community.ivanti.com/docs/DOC-74552]
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.
[http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html]
[20190423 Multiple vulnerabilities in Sony Smart TVs]
[108072]
[20190424 Multiple vulnerabilities in Sony Smart TVs]
[https://www.sony.com/electronics/support/downloads/00016043]
A reflected HTML injection vulnerability on Salicru SLC-20-cube3(5) devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name= request.
[http://packetstormsecurity.com/files/152435/SaLICru-SLC-20-cube3-5-HTML-Injection.html]
[https://github.com/Ramikan/Vulnerabilities/blob/master/Salicru-%20UPS-Reflected%20HTML%20Injection]
[46667]
A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html.
[https://github.com/yxcmf/ukcms/issues/4]
An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request. To exploit this vulnerability, a low level authenticated attacker could run a specially crafted application. The security update addresses this vulnerability by correcting how rpcss.dll handles these requests., aka 'Windows RPCSS Elevation of Privilege Vulnerability'.
[http://packetstormsecurity.com/files/153683/Microsoft-Windows-RPCSS-Activation-Kernel-Security-Callback-Privilege-Escalation.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1089]
An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checking the parameter that can be controlled by user, and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header.
[https://github.com/Kirin-say/Vulnerabilities/blob/master/DIR-806_Code_Injection.md]
An issue was discovered in D-Link DIR-806 devices. There is a stack-based buffer overflow in function hnap_main at /htdocs/cgibin. The function will call sprintf without checking the length of strings in parameters given by HTTP header and can be controlled by users. And it finally leads to a stack-based buffer overflow via a special HTTP header.
[https://github.com/Kirin-say/Vulnerabilities/blob/master/DIR-806_Stack_Overflow_to_Run_Shellcode.md]
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.
[http://forum.centos-webpanel.com/informations/]
[http://packetstormsecurity.com/files/152437/CentOS-Web-Panel-0.9.8.793-Free-0.9.8.753-Pro-Cross-Site-Scripting.html]
[108035]
[https://packetstormsecurity.com/files/152437/centoswp098email-xss.txt]
[46669]
[46669]
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called.
[openSUSE-SU-2019:1356]
[openSUSE-SU-2019:1390]
[107834]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15613]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b20e5d8aae2580e29c83ddaf0b6b2e640603e4aa]
[[debian-lts-announce] 20190525 [SECURITY] [DLA 1802-1] wireshark security update]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[USN-3986-1]
[https://www.wireshark.org/security/wnpa-sec-2019-14.html]
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
[openSUSE-SU-2019:1356]
[openSUSE-SU-2019:1390]
[107834]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15497]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=2fbbde780e5d5d82e31dca656217daf278cf62bb]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=38680c4c69f9f4e0f39e29b66fe2b02d88eb629d]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=cab0cff6abdd7a5b5b0bfa4ee204eea951e129e9]
[[debian-lts-announce] 20190525 [SECURITY] [DLA 1802-1] wireshark security update]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[USN-3986-1]
[https://www.wireshark.org/security/wnpa-sec-2019-09.html]
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
[openSUSE-SU-2019:1356]
[openSUSE-SU-2019:1390]
[107834]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15617]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=441b6d9071d6341e58dfe10719375489c5b8e3f0]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[USN-3986-1]
[https://www.wireshark.org/security/wnpa-sec-2019-15.html]
In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-ieee80211.c by detecting cases in which the bit offset does not advance.
[107836]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15553]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=00d5e9e9fb377f52ab7696f25c1dbc011ef0244d]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[https://www.wireshark.org/security/wnpa-sec-2019-11.html]
In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gsm_gsup.c by rejecting an invalid Information Element length.
[107836]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15585]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f80b7d1b279fb6c13f640019a1bbc42b18bf7469]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[https://www.wireshark.org/security/wnpa-sec-2019-12.html]
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read.
[openSUSE-SU-2019:1356]
[openSUSE-SU-2019:1390]
[107834]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15546]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b16fea2f175a3297edac118c8844c7987d31c1cb]
[[debian-lts-announce] 20190525 [SECURITY] [DLA 1802-1] wireshark security update]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[USN-3986-1]
[https://www.wireshark.org/security/wnpa-sec-2019-10.html]
An elevation of privilege vulnerability exists in the way that the dnsrslvr.dll handles objects in memory, aka 'Windows dnsrlvr.dll Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1090]
In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. This was addressed in epan/dissectors/file-rbm.c by handling unknown object types safely.
[107836]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15612]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=26eee01f57f0a86fb375892c7937eac24ede4610]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[https://www.wireshark.org/security/wnpa-sec-2019-13.html]
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly.
[openSUSE-SU-2019:1356]
[openSUSE-SU-2019:1390]
[107834]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15620]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=cf801a25074f76dc3ae62d8ec53ace75f56ce2cd]
[[debian-lts-announce] 20190525 [SECURITY] [DLA 1802-1] wireshark security update]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[USN-3986-1]
[https://www.wireshark.org/security/wnpa-sec-2019-17.html]
In Wireshark 3.0.0, the TSDNS dissector could crash. This was addressed in epan/dissectors/packet-tsdns.c by splitting strings safely.
[107836]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15619]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=95571f17d5e2de39735e62e5251583f930c06d51]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[https://www.wireshark.org/security/wnpa-sec-2019-16.html]
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check.
[openSUSE-SU-2019:1356]
[openSUSE-SU-2019:1390]
[107834]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15568]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=eafdcfa4b6d5187a5326442a82608ab03d9dddcb]
[[debian-lts-announce] 20190525 [SECURITY] [DLA 1802-1] wireshark security update]
[FEDORA-2019-77b2d840ef]
[FEDORA-2019-aef1dac6a0]
[USN-3986-1]
[https://www.wireshark.org/security/wnpa-sec-2019-18.html]
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
[[oss-security] 20190407 Re: XSS in roundup bug tracker 404 page]
[https://bugs.python.org/issue36391]
[https://github.com/python/bugs.python.org/issues/34]
[[debian-lts-announce] 20190407 [SECURITY] [DLA 1750-1] roundup security update]
[https://www.openwall.com/lists/oss-security/2019/04/05/1]
Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring.
[https://github.com/erusev/parsedown/issues/699]
[https://github.com/erusev/parsedown/releases/tag/1.7.2]
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
[openSUSE-SU-2019:1395]
[openSUSE-SU-2019:1614]
[RHSA-2019:1152]
[RHSA-2019:1237]
[RHSA-2019:1329]
[[infra-devnull] 20190410 [GitHub] [airflow] ashb closed pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906]
[[infra-devnull] 20190410 [GitHub] [airflow] ashb commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906]
[[infra-devnull] 20190410 [GitHub] [airflow] XD-DENG commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906]
[[infra-devnull] 20190410 [GitHub] [airflow] XD-DENG opened pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906]
[[airflow-commits] 20190410 [GitHub] [airflow] ashb commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906]
[[airflow-commits] 20190410 [GitHub] [airflow] ashb merged pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906]
[[airflow-commits] 20190410 [GitHub] [airflow] XD-DENG opened a new pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906]
[[airflow-commits] 20190410 [GitHub] [airflow] XD-DENG commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906]
[FEDORA-2019-e41e19457b]
[FEDORA-2019-4f978cacb4]
[FEDORA-2019-04a42e480b]
[https://palletsprojects.com/blog/jinja-2-10-1-released]
[USN-4011-1]
[USN-4011-2]
Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.
[https://github.com/airsonic/airsonic/commit/3e07ea52885f88d3fbec444dfd592f27bfb65647]
In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks.
[https://github.com/airsonic/airsonic/commit/61c842923a6d60d4aedd126445a8437b53b752c8]
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
[https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2]
[https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine]
[https://www.drupal.org/sa-core-2019-005]
An information disclosure vulnerability exists when Unistore.dll fails to properly handle objects in memory, aka 'Microsoft unistore.dll Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1091]
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
[https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b]
[https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid]
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
[https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081]
[https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash]
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
[https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b]
[FEDORA-2019-a3ca65028c]
[FEDORA-2019-f8db687840]
[FEDORA-2019-3ee6a7adf2]
[FEDORA-2019-32067d8b15]
[FEDORA-2019-2a7f472198]
[FEDORA-2019-8635280de5]
[FEDORA-2019-0ef4149687]
[FEDORA-2019-f5d6a7ce74]
[20190510 [SECURITY] [DSA 4441-1] symfony security update]
[https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized]
[https://typo3.org/security/advisory/typo3-core-sa-2019-016/]
[DSA-4441]
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
[https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec]
[https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides]
pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer overflow during X.509 certificate verification because of missing validation in psRsaDecryptPubExt in crypto/pubkey/rsa_pub.c.
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1785]
[https://github.com/matrixssl/matrixssl/issues/26]
[https://github.com/matrixssl/matrixssl/releases/tag/4-0-2-open]
[https://www.openwall.com/lists/oss-security/2019/02/15/1]
A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration web application (TIA Administrator) allows to execute certain application commands without proper authentication. The vulnerability could be exploited by an attacker with local access to the affected system. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
[109124]
[https://cert-portal.siemens.com/productcert/pdf/ssa-721298.pdf]
[https://cert-portal.siemens.com/productcert/pdf/ssa-834884.pdf]
[https://www.us-cert.gov/ics/advisories/icsa-19-253-02]
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
[https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf]
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
[https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf]
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An authenticatd attacker with network access to the DCOM interface could execute arbitrary commands with SYSTEM privileges. The vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires authentication with a low-privileged user account and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
[https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf]
A vulnerability has been identified in LOGO!8 BM (All versions). Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
[http://packetstormsecurity.com/files/153123/Siemens-LOGO-8-Missing-Authentication.html]
[20190529 [SYSS-2019-013]: Siemens LOGO! 8 - Missing Authentication for Critical Function (CWE-306)]
[108382]
[https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf]
[20190529 [SYSS-2019-013]: Siemens LOGO! 8 - Missing Authentication for Critical Function (CWE-306)]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062, CVE-2019-1103, CVE-2019-1106, CVE-2019-1107.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1092]
A vulnerability has been identified in LOGO!8 BM (All versions). Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
[http://packetstormsecurity.com/files/153122/Siemens-LOGO-8-Hard-Coded-Cryptographic-Key.html]
[20190529 [SYSS-2019-012]: Siemens LOGO! 8 - Use of Hard-coded Cryptographic Key (CWE-321)]
[108382]
[https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf]
[20190529 [SYSS-2019-012]: Siemens LOGO! 8 - Use of Hard-coded Cryptographic Key (CWE-321)]
A vulnerability has been identified in LOGO!8 BM (All versions). Unencrypted storage of passwords in the project could allow an attacker with access to port 10005/tcp to obtain passwords of the device. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known
[http://packetstormsecurity.com/files/153124/Siemens-LOGO-8-Recoverable-Password-Format.html]
[20190529 [SYSS-2019-014]: Siemens LOGO! 8 - Storing Passwords in a Recoverable Format (CWE-257)]
[108382]
[https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf]
[20190529 [SYSS-2019-014]: Siemens LOGO! 8 - Storing Passwords in a Recoverable Format (CWE-257)]
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 and newer (All versions). An attacker with network access to affected installations, which are configured without "Encrypted Communication", can execute arbitrary code. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected installation. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
[108398]
[https://cert-portal.siemens.com/productcert/pdf/ssa-705517.pdf]
A vulnerability has been identified in CP1604 (All versions < V2.8), CP1616 (All versions < V2.8), Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (All versions < V4.1.1 Patch 05), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 (All versions < V4.5.0 Patch 01), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P (All versions < V4.5.0), SCALANCE X-200IRT (All versions < V5.2.1), SIMATIC ET 200M (All versions), SIMATIC ET 200S (All versions), SIMATIC ET 200ecoPN (except 6ES7148-6JD00-0AB0 and 6ES7146-6FF00-0AB0) (All versions), SIMATIC ET 200pro (All versions), SIMATIC PN/PN Coupler 6ES7158-3AD01-0XA0 (All versions), SIMATIC S7-300 CPU family (incl. F) (All versions), SIMATIC S7-400 (incl. F) V6 and below (All versions), SIMATIC S7-400 PN/DP V7 (incl. F) (All versions), SIMATIC WinAC RTX (F) 2010 (All versions < SIMATIC WinAC RTX 2010 SP3), SIMOTION (All versions), SINAMICS DCM (All versions < V1.5 HF1), SINAMICS DCP (All versions), SINAMICS G110M V4.7 (Control Unit) (All versions < V4.7 SP10 HF5), SINAMICS G120 V4.7 (Control Unit) (All versions < V4.7 SP10 HF5), SINAMICS G130 V4.7 (Control Unit) (All versions < V4.7 HF29), SINAMICS G150 (Control Unit) (All versions < V4.8), SINAMICS GH150 V4.7 (Control Unit) (All versions), SINAMICS GL150 V4.7 (Control Unit) (All versions), SINAMICS GM150 V4.7 (Control Unit) (All versions), SINAMICS S110 (Control Unit) (All versions), SINAMICS S120 V4.7 (Control Unit and CBE20) (All versions < V4.7 HF34), SINAMICS S150 (Control Unit) (All versions < V4.8), SINAMICS SL150 V4.7 (Control Unit) (All versions), SINAMICS SM120 V4.7 (Control Unit) (All versions), SINUMERIK 828D (All versions < V4.8 SP5), SINUMERIK 840D sl (All versions). An attacker with network access to an affected product may cause a Denial-of-Service condition by breaking the real-time synchronization (IRT) of the affected installation. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected installation. No user interaction is required to exploit this security vulnerability. The vulnerability impacts the availability of the affected installations.
[https://cert-portal.siemens.com/productcert/pdf/ssa-349422.pdf]
A vulnerability has been identified in LOGO! Soft Comfort (All versions). The vulnerability could allow an attacker to execute arbitrary code if the attacker tricks a legitimate user to open a manipulated project. In order to exploit the vulnerability, a valid user must open a manipulated project file. No further privileges are required on the target system. The vulnerability could compromise the confidentiality, integrity and availability of the engineering station. At the time of advisory publication no public exploitation of this security vulnerability was known.
[108368]
[https://cert-portal.siemens.com/productcert/pdf/ssa-102144.pdf]
A vulnerability has been identified in SIMATIC Ident MV420 family (All versions), SIMATIC Ident MV440 family (All versions). An authenticated attacker could escalate privileges by sending specially crafted requests to the integrated webserver. The security vulnerability can be exploited by an attacker with network access to the device. Valid user credentials, but no user interaction are required. Successful exploitation compromises integrity and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
[108725]
[https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdf]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-162-02]
A vulnerability has been identified in SIMATIC Ident MV420 family (All versions), SIMATIC Ident MV440 family (All versions). Communication with the device is not encrypted. Data transmitted between the device and the user can be obtained by an attacker in a privileged network position. The security vulnerability can be exploited by an attacker in a privileged network position which allows evesdropping the communication between the affected device and the user. The user must invoke a session. Successful exploitation of the vulnerability compromises confidentiality of the data transmitted. At the time of advisory publication no public exploitation of this security vulnerability was known.
[108725]
[https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdf]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-162-02]
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.
[N/A]
A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device.
[N/A]
A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (All versions), SIMATIC S7-1200 CPU family (All versions >= V4.0), SIMATIC S7-1500 CPU family (All versions), SIMATIC S7-1500 Software Controller (All versions), SIMATIC S7-PLCSIM Advanced (All versions). An attacker in a Man-in-the-Middle position could potentially modify network traffic exchanged on port 102/tcp, due to certain properties in the calculation used for integrity protection. In order to exploit the vulnerability, an attacker must be able to perform a Man-in-the-Middle attack. The vulnerability could impact the integrity of the communication. No public exploitation of the vulnerability was known at the time of advisory publication.
[N/A]
An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1097.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1093]
A vulnerability has been identified in SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.90), All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions), DIGSI 5 engineering software (All versions < V7.90). A remote attacker could use specially crafted packets sent to port 443/TCP to upload, download or delete files in certain parts of the file system.
[https://cert-portal.siemens.com/productcert/pdf/ssa-899560.pdf]
A vulnerability has been identified in SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.90), All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions), DIGSI 5 engineering software (All versions < V7.90). Specially crafted packets sent to port 443/TCP could cause a Denial of Service condition.
[https://cert-portal.siemens.com/productcert/pdf/ssa-899560.pdf]
A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate User Interface) (Version v4.75), Spectrum Power 5 (Corporate User Interface) (All versions < v5.50), Spectrum Power 7 (Corporate User Interface) (All versions <= v2.20). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user does not need to be logged into the web interface in order for the exploitation to succeed.At the stage of publishing this security advisory no public exploitation is known.
[https://cert-portal.siemens.com/productcert/pdf/ssa-747162.pdf]
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd 11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC Professional (TIA Portal V13) (All versions), SIMATIC WinCC Professional (TIA Portal V14) (All versions < V14 SP1 Upd 9), SIMATIC WinCC Professional (TIA Portal V15) (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). The SIMATIC WinCC DataMonitor web application of the affected products allows to upload arbitrary ASPX code. The security vulnerability could be exploited by an authenticated attacker with network access to the WinCC DataMonitor application. No user interaction is required to exploit this vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the affected device. At the stage of publishing this security advisory no public exploitation is known.
[https://cert-portal.siemens.com/productcert/pdf/ssa-121293.pdf]
A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (All versions), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 (All versions), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P (All versions), SIMATIC CFU PA (All versions < V1.2.0), SIMATIC ET 200AL (All versions), SIMATIC ET 200M (All versions), SIMATIC ET 200MP IM 155-5 PN BA (All versions < V4.2.3), SIMATIC ET 200MP IM 155-5 PN HF (All versions), SIMATIC ET 200MP IM 155-5 PN ST (All versions), SIMATIC ET 200S (All versions), SIMATIC ET 200SP IM 155-6 PN BA (All versions), SIMATIC ET 200SP IM 155-6 PN HA (All versions), SIMATIC ET 200SP IM 155-6 PN HF (All versions < V4.2.2), SIMATIC ET 200SP IM 155-6 PN HS (All versions), SIMATIC ET 200SP IM 155-6 PN ST (All versions), SIMATIC ET 200SP IM 155-6 PN/2 HF (All versions < V4.2.2), SIMATIC ET 200SP IM 155-6 PN/3 HF (All versions < V4.2.1), SIMATIC ET 200ecoPN (except 6ES7148-6JD00-0AB0 and 6ES7146-6FF00-0AB0) (All versions), SIMATIC ET 200pro (All versions), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions), SIMATIC HMI Comfort Panels 4" - 22" (All versions), SIMATIC HMI KTP Mobile Panels (All versions), SIMATIC PN/PN Coupler (All versions), SIMATIC PROFINET Driver (All versions < V2.1), SIMATIC S7-1200 CPU family (incl. F) (All versions), SIMATIC S7-1500 CPU family (incl. F) (All versions < V2.0), SIMATIC S7-300 CPU family (incl. F) (All versions), SIMATIC S7-400 PN/DP V7 (incl. F) (All versions), SIMATIC S7-400 V6 (incl F) and below (All versions), SIMATIC S7-400H V6 (All versions < V6.0.9), SIMATIC S7-410 V8 (All versions), SIMATIC WinAC RTX (F) 2010 (All versions < SIMATIC WinAC RTX 2010 SP3), SINAMICS DCM (All versions < V1.5 HF1), SINAMICS DCP (All versions), SINAMICS G110M V4.7 (PN Control Unit) (All versions < V4.7 SP10 HF5), SINAMICS G120 V4.7 (PN Control Unit) (All versions < V4.7 SP10 HF5), SINAMICS G130 V4.7 (Control Unit) (All versions), SINAMICS G150 (Control Unit) (All versions), SINAMICS GH150 V4.7 (Control Unit) (All versions), SINAMICS GL150 V4.7 (Control Unit) (All versions), SINAMICS GM150 V4.7 (Control Unit) (All versions), SINAMICS S110 (Control Unit) (All versions), SINAMICS S120 V4.7 (Control Unit) (All versions), SINAMICS S150 (Control Unit) (All versions), SINAMICS SL150 V4.7 (Control Unit) (All versions), SINAMICS SM120 V4.7 (Control Unit) (All versions), SINUMERIK 828D (All versions < V4.8 SP5), SINUMERIK 840D sl (All versions). Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large amount of specially crafted UDP packets are sent to device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
[https://cert-portal.siemens.com/productcert/pdf/ssa-473245.pdf]
A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to the device could cause a Denial-of-Service condition by sending a specially crafted UDP packet. The vulnerability affects the UDP communication of the device. The security vulnerability could be exploited without authentication. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
[https://cert-portal.siemens.com/productcert/pdf/ssa-250618.pdf]
[https://www.us-cert.gov/ics/advisories/icsa-19-253-05]
A vulnerability has been identified in Ethernet plug-in communication modules for SIPROTEC 5 devices with CPU variants CP200 (All versions), SIPROTEC 5 devices with CPU variants CP300 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device.
[https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1095, CVE-2019-1098, CVE-2019-1099, CVE-2019-1100, CVE-2019-1101, CVE-2019-1116.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1094]
A vulnerability has been identified in SCALANCE X-200 (All versions), SCALANCE X-200IRT (All versions), SCALANCE X-200RNA (All versions). The device contains a vulnerability that could allow an attacker to trigger a denial-of-service condition by sending large message packages repeatedly to the telnet service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
[N/A]
A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (All versions), SIMATIC S7-1200 CPU family (All versions >= V4.0), SIMATIC S7-1500 CPU family (All versions), SIMATIC S7-1500 Software Controller (All versions), SIMATIC S7-PLCSIM Advanced (All versions). An attacker with network access to port 102/tcp could potentially modify the user program on the PLC in a way that the running code is different from the source code which is stored on the device. An attacker must have network access to affected devices and must be able to perform changes to the user program. The vulnerability could impact the perceived integrity of the user program stored on the CPU. An engineer that tries to obtain the code of the user program running on the device, can receive different source code that is not actually running on the device. No public exploitation of the vulnerability was known at the time of advisory publication.
[N/A]
An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.
[http://packetstormsecurity.com/files/152515/Joomla-3.9.4-Arbitrary-File-Deletion-Directory-Traversal.html]
[https://developer.joomla.org/security-centre/777-20190401-core-directory-traversal-in-com-media]
[46710]
An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.
[https://developer.joomla.org/security-centre/778-20190402-core-helpsites-refresh-endpoint-callable-for-unauthenticated-users]
Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. This may occur because CNCSoft lacks user input validation before copying data from project files onto the stack.
[107989]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01]
[https://www.zerodayinitiative.com/advisories/ZDI-19-399/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-400/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-401/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-402/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-403/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-404/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-410/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-417/]
Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X are susceptible to a denial-of-service condition as a result of an overflow of TCP packets, which requires the device to be manually rebooted.
[https://ics-cert.us-cert.gov/advisories/ICSMA-19-113-01]
Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple out-of-bounds read vulnerabilities may be exploited, allowing information disclosure due to a lack of user input validation for processing specially crafted project files.
[107989]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01]
[https://www.zerodayinitiative.com/advisories/ZDI-19-406/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-407/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-409/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-411/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-412/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-413/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-414/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-415/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-416/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-418/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-419/]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1098, CVE-2019-1099, CVE-2019-1100, CVE-2019-1101, CVE-2019-1116.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1095]
Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X provide insecure telnet services that lack authentication requirements. An attacker who successfully exploits this vulnerability may be able to access the underlying operating system.
[108052]
[https://ics-cert.us-cert.gov/advisories/ICSMA-19-113-01]
Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap.
[107989]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01]
[https://www.zerodayinitiative.com/advisories/ZDI-19-405/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-408/]
An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 to 30.014 and earlier systems.
[108118]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01]
ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets.
[108413]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-106-03]
An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable faulted state (MNRF) in CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 to 30.014 and earlier.
[108118]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01]
In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, CompactLogix 5370 L1 controllers v30.014 and earlier, CompactLogix 5370 L2 controllers v30.014 and earlier, CompactLogix 5370 L3 controllers (includes CompactLogix GuardLogix controllers) v30.014 and earlier, an open redirect vulnerability could allow a remote unauthenticated attacker to input a malicious link to redirect users to a malicious site that could run or download arbitrary malware on the user?s machine.
[https://ics-cert.us-cert.gov/advisories/ICSA-19-113-01]
[108049]
BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update.
[108765]
[https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01]
[https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/alaris-gateway-workstation-unauthorized-firmware]
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1096]
Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.
[https://www.us-cert.gov/ics/advisories/icsa-19-232-01]
In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, allowing remote code execution.
[https://www.us-cert.gov/ics/advisories/icsa-19-213-01]
[https://www.zerodayinitiative.com/advisories/ZDI-19-691/]
BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of the IP address of the Alaris Gateway Workstation terminal to gain access to the status and configuration information of the device.
[108763]
[https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01]
Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosure. Log files must have previously been exported by a legitimate user.
[https://www.us-cert.gov/ics/advisories/icsa-19-274-03]
In Medtronic MinMed 508 and Medtronic Minimed Paradigm Insulin Pumps, Versions, MiniMed 508 pump ? All versions, MiniMed Paradigm 511 pump ? All versions, MiniMed Paradigm 512/712 pumps ? All versions, MiniMed Paradigm 712E pump?All versions, MiniMed Paradigm 515/715 pumps?All versions, MiniMed Paradigm 522/722 pumps ? All versions,MiniMed Paradigm 522K/722K pumps ? All versions, MiniMed Paradigm 523/723 pumps ? Software versions 2.4A or lower, MiniMed Paradigm 523K/723K pumps ? Software, versions 2.4A or lower, MiniMed Paradigm Veo 554/754 pumps ? Software versions 2.6A or lower, MiniMed Paradigm Veo 554CM and 754CM models only ? Software versions 2.7A or lower, the affected insulin pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
[108926]
[https://www.us-cert.gov/ics/advisories/icsma-19-178-01]
In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.
[108499]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01]
In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP network configuration, which could allow an attacker to remotely modify device configuration and silence alarms.
[109102]
[https://www.us-cert.gov/ics/advisories/icsma-19-190-01]
In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a stack-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long file name from the LIST command to the FTP service, which may cause the service to overwrite buffers, leading to remote code execution and escalation of privileges.
[108499]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01]
Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabled.
[https://www.us-cert.gov/ics/advisories/icsma-19-192-01]
Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the router, which may allow an attacker to perform remote code execution.
[https://www.us-cert.gov/ics/advisories/icsa-19-274-03]
An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1093.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1097]
In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, unauthenticated threat actor with access to an affected PanelView 5510 Graphic Display, upon successful exploit, may boot-up the terminal and gain root-level access to the device?s file system.
[109105]
[https://www.us-cert.gov/ics/advisories/icsa-19-190-02]
The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories.
[https://ics-cert.us-cert.gov/advisories/ICSA-19-134-01]
Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with a rogue project file (.frc2). Once a user opens the rogue project, CPU exhaustion occurs, which causes the software to quit responding until the application is restarted.
[https://www.us-cert.gov/ics/advisories/icsa-19-204-01]
Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface.
[109001]
[https://www.us-cert.gov/ics/advisories/icsa-19-183-02]
NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten with arbitrary code.
[https://www.us-cert.gov/ics/advisories/icsa-19-204-02]
An out-of-bounds read vulnerability has been identified in Fuji Electric Alpha7 PC Loader Versions 1.1 and prior, which may crash the system.
[108359]
[https://felib.fujielectric.co.jp/download/search2.htm?dosearch=1&site=global&lang=en&documentGroup=software]
[https://www.zerodayinitiative.com/advisories/ZDI-19-517/]
Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.
[https://www.us-cert.gov/ics/advisories/icsa-19-204-01]
In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets against the FTP service, forcing the target devices to enter an error mode and cause a denial-of-service condition.
[108419]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-141-02]
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the designated memory area.
[https://www.us-cert.gov/ics/advisories/icsa-19-248-01]
SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.
[108924]
[https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories]
[https://www.us-cert.gov/ics/advisories/icsa-19-178-04]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1095, CVE-2019-1099, CVE-2019-1100, CVE-2019-1101, CVE-2019-1116.
[N/A]
A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute remote code. The attacker must have local access to the system. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
[https://www.us-cert.gov/ics/advisories/icsa-19-213-06]
In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect user credentials.
[108543]
[https://ics-cert.us-cert.gov/advisories/ICSA-19-150-01]
[https://security.cse.iitk.ac.in/responsible-disclosure]
[https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityAdvisory_LFSec136.pdf]
Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap.
[https://www.us-cert.gov/ics/advisories/icsa-19-192-01]
In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation of this vulnerability may allow disclosure of information.
[https://www.us-cert.gov/ics/advisories/icsa-19-178-05]
[https://www.zerodayinitiative.com/advisories/ZDI-19-621/]
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that causes the program to mishandle pointers.
[https://www.us-cert.gov/ics/advisories/icsa-19-248-01]
In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage this vulnerability to delete files while posing as an administrator.
[https://www.us-cert.gov/ics/advisories/icsa-19-178-05]
[https://www.zerodayinitiative.com/advisories/ZDI-19-622/]
In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.
[https://www.us-cert.gov/ics/advisories/icsa-19-178-05]
[https://www.zerodayinitiative.com/advisories/ZDI-19-584/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-587/]
In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 Ultrasound System is built on an old operating system that is no longer supported. Thus, any unmitigated vulnerability in the old operating system could be exploited to affect this product.
[https://www.us-cert.gov/ics/advisories/icsma-19-241-02]
In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. Note: A different vulnerability than CVE-2019-10991.
[https://www.us-cert.gov/ics/advisories/icsa-19-178-05]
[https://www.zerodayinitiative.com/advisories/ZDI-19-590/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-591/]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1095, CVE-2019-1098, CVE-2019-1100, CVE-2019-1101, CVE-2019-1116.
[N/A]
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files.
[https://www.us-cert.gov/ics/advisories/icsa-19-248-01]
In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.
[https://www.us-cert.gov/ics/advisories/icsa-19-178-05]
[https://www.zerodayinitiative.com/advisories/ZDI-19-586/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-588/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-589/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-592/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-594/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-619/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-620/]
Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple out-of-bounds read vulnerabilities may cause information disclosure due to lacking user input validation for processing project files.
[https://www.us-cert.gov/ics/advisories/icsa-19-192-01]
In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code.
[https://www.us-cert.gov/ics/advisories/icsa-19-178-05]
[https://www.zerodayinitiative.com/advisories/ZDI-19-597/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-598/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-601/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-602/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-603/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-605/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-606/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-607/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-611/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-612/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-613/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-614/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-615/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-616/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-617/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-618/]
[https://www.zerodayinitiative.com/advisories/ZDI-19-623/]
Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive information. The attacker must have local access to the system. A CVSS v3 base score of 2.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
[https://www.us-cert.gov/ics/advisories/icsa-19-213-06]
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that can reference memory after it has been freed.
[https://www.us-cert.gov/ics/advisories/icsa-19-248-01]
An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Protocol Fuzzing on PC WORX Engineer by a man in the middle attacker stops the PLC service. The device must be rebooted, or the PLC service must be restarted manually via a Linux shell.
[https://dam-mdc.phoenixcontact.com/asset/156443151564/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf]
An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Unlimited physical access to the PLC may lead to a manipulation of SD cards data. SD card manipulation may lead to an authentication bypass opportunity.
[https://dam-mdc.phoenixcontact.com/asset/156443151564/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf]
The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a remotely authenticated attacker to execute arbitrary code by providing a long string in the WEPEncryption parameter when requesting wireless.htm. Vulnerable devices include DCS-5009L (1.08.11 and below), DCS-5010L (1.14.09 and below), DCS-5020L (1.15.12 and below), DCS-5025L (1.03.07 and below), DCS-5030L (1.04.10 and below), DCS-930L (2.16.01 and below), DCS-931L (1.14.11 and below), DCS-932L (2.17.01 and below), DCS-933L (1.14.11 and below), and DCS-934L (1.05.04 and below).
[https://github.com/fuzzywalls/CVE-2019-10999]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1095, CVE-2019-1098, CVE-2019-1099, CVE-2019-1101, CVE-2019-1116.
[N/A]
An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure.
[108301]
[https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/]
[https://about.gitlab.com/blog/categories/releases/]
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
[https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py]
[https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/]
In Materialize through 1.0.0, XSS is possible via the Tooltip feature.
[https://github.com/Dogfalo/materialize/issues/6286]
In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.
[https://github.com/Dogfalo/materialize/issues/6286]
In Materialize through 1.0.0, XSS is possible via the Toast feature.
[https://github.com/Dogfalo/materialize/issues/6286]
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a quoted font family value.
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b6fb77d7d54d]
[openSUSE-SU-2019:1272]
[openSUSE-SU-2019:1295]
[https://sourceforge.net/p/graphicsmagick/bugs/600/]
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which allows attackers to cause a denial of service or information disclosure via an RLE packet.
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/f7610c1281c1]
[openSUSE-SU-2019:1272]
[openSUSE-SU-2019:1295]
[[debian-lts-announce] 20190413 [SECURITY] [DLA 1755-1] graphicsmagick security update]
[https://sourceforge.net/p/graphicsmagick/bugs/598/]
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allows attackers to cause a denial of service or information disclosure via an image colormap.
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/40fc71472b98]
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/86a9295e7c83]
[openSUSE-SU-2019:1272]
[openSUSE-SU-2019:1295]
[openSUSE-SU-2019:1320]
[openSUSE-SU-2019:1331]
[[debian-lts-announce] 20190413 [SECURITY] [DLA 1755-1] graphicsmagick security update]
[https://sourceforge.net/p/graphicsmagick/bugs/596/]
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/d823d23a474b]
[openSUSE-SU-2019:1272]
[openSUSE-SU-2019:1295]
[openSUSE-SU-2019:1320]
[openSUSE-SU-2019:1331]
[openSUSE-SU-2019:1354]
[openSUSE-SU-2019:1355]
[openSUSE-SU-2019:1437]
[[debian-lts-announce] 20190413 [SECURITY] [DLA 1755-1] graphicsmagick security update]
[https://sourceforge.net/p/graphicsmagick/bugs/599/]
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allows attackers to cause a denial of service or information disclosure via a crafted image file.
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/7cff2b1792de]
[openSUSE-SU-2019:1272]
[openSUSE-SU-2019:1295]
[openSUSE-SU-2019:1320]
[openSUSE-SU-2019:1354]
[openSUSE-SU-2019:1355]
[openSUSE-SU-2019:1437]
[[debian-lts-announce] 20190413 [SECURITY] [DLA 1755-1] graphicsmagick security update]
[https://sourceforge.net/p/graphicsmagick/bugs/597/]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1095, CVE-2019-1098, CVE-2019-1099, CVE-2019-1100, CVE-2019-1116.
[N/A]
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to cause a denial of service via a crafted image file.
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/a348d9661019]
[openSUSE-SU-2019:1272]
[openSUSE-SU-2019:1295]
[[debian-lts-announce] 20190413 [SECURITY] [DLA 1755-1] graphicsmagick security update]
[https://sourceforge.net/p/graphicsmagick/bugs/601/]
Akamai CloudTest before 58.30 allows remote code execution.
[https://blogs.akamai.com/sitr/2019/06/cloudtest-vulnerability-cve-2019-11011.html]
Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on the remote server.
[http://packetstormsecurity.com/files/154196/Nimble-Streamer-3.x-Directory-Traversal.html]
[https://mayaseven.com/nimble-directory-traversal-in-nimble-streamer-version-3-0-2-2-to-3-5-4-9/]
The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not prevent spoofing of the camera server. An attacker can create a fake camera server that listens for the client looking for a camera on the local network. When the camera responds to the client, it responds via the broadcast address, giving all information necessary to impersonate the camera. The attacker then floods the client with responses, causing the original camera to be denied service from the client, and thus causing the client to then communicate exclusively with the attacker's fake camera server. When connecting to the fake camera server, the client sends all details necessary to login to the camera (username and password).
[http://blog.0x42424242.in/2019/03/vstarcam-investigational-security.html]
[http://blog.0x42424242.in/2019/03/vstarcam-investigational-security_22.html]
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials (partially). This occurs because of paste access to a social media login page.
[https://www.andmp.com/2019/04/unpatched-vulnerability-in-xiaomi-miui-os-lock-screen.html]
Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.
[https://elgg.org/blog/view/2913744/security-release-elgg-11218-and-2311]
[https://github.com/Elgg/Elgg/releases/tag/1.12.18]
[https://github.com/Elgg/Elgg/releases/tag/2.3.11]
On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smap, as demonstrated by the cgi-bin/smap RC parameter.
[http://packetstormsecurity.com/files/152465/D-Link-DI-524-2.06RU-Cross-Site-Scripting.html]
[46687]
application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.
[https://github.com/zoujingli/ThinkAdmin/issues/173]
Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim details by visiting easily guessable exportpdf/all_claim_detail.php?claim_id= URLs.
[http://ddrt.co.uk/complaint-handling-software/]
[https://domdomegg.github.io/CVE-2019-11019.pdf]
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
[N/A]
Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visiting easily guessable dashboard/uploads/claim_files/claim_id_ URLs.
[http://ddrt.co.uk/complaint-handling-software/]
[https://domdomegg.github.io/CVE-2019-11020.pdf]
The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graphml2gv.
[openSUSE-SU-2019:1434]
[openSUSE-SU-2019:1459]
[https://gitlab.com/graphviz/graphviz/issues/1517]
[FEDORA-2019-feeb1a2543]
[FEDORA-2019-521e6c567c]
[https://research.loginsoft.com/bugs/null-pointer-dereference-in-function-agroot/]
The load_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion.
[https://github.com/saitoha/libsixel/issues/85]
[https://research.loginsoft.com/bugs/1501/]
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.
[https://github.com/Cacti/cacti/compare/6ea486a...99995bb]
[https://github.com/Cacti/cacti/issues/2581]
[[debian-lts-announce] 20190416 [SECURITY] [DLA 1757-1] cacti security update]
FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
[https://gitlab.freedesktop.org/poppler/poppler/issues/752]
[FEDORA-2019-1ddce0c095]
[FEDORA-2019-3193a75b06]
[FEDORA-2019-95eb49ef49]
[https://research.loginsoft.com/bugs/1508/]
Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
[https://github.com/openid/ruby-openid/issues/122]
[[debian-lts-announce] 20191011 [SECURITY] [DLA 1956-1] ruby-openid security update]
[https://marc.info/?l=openid-security&m=155154717027534&w=2]
GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx".
[http://packetstormsecurity.com/files/152643/GAT-Ship-Web-Module-Unrestricted-File-Upload.html]
[20190426 Re: GAT-Ship Web Module [All versions before 1.40] - Unrestricted File Upload]
[20190409 GAT-Ship Web Module [All versions before 1.40] - Unrestricted File Upload]
[https://vuldb.com/?id.133141]
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.
[https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062, CVE-2019-1092, CVE-2019-1106, CVE-2019-1107.
[N/A]
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget (contained in a serialized object) may be executed with SYSTEM privileges. The attacker must properly encrypt the object; however, the hardcoded keys are available.
[https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution]
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a Setup-Files action, and then execute these files with SYSTEM privileges.
[https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution]
In EasyToRecruit (E2R) before 2.11, the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting (XSS) injection in multiple locations.
[https://www.excellium-services.com/cert-xlm-advisory/]
[https://www.excellium-services.com/cert-xlm-advisory/cve-2019-11032/]
Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring.
[https://support.applaudsolutions.com/hc/en-us/articles/203794318-Download-latest-Applaud-HCM-patch]
[https://www.applaudsolutions.com/resources/]
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
[openSUSE-SU-2019:1501]
[openSUSE-SU-2019:1503]
[openSUSE-SU-2019:1572]
[openSUSE-SU-2019:1573]
[RHSA-2019:2519]
[https://bugs.php.net/bug.php?id=77753]
[[debian-lts-announce] 20190525 [SECURITY] [DLA 1803-1] php5 security update]
[20190923 [SECURITY] [DSA 4529-1] php7.0 security update]
[https://security.netapp.com/advisory/ntap-20190502-0001/]
[https://support.f5.com/csp/article/K44590877]
[USN-3953-1]
[USN-3953-2]
[DSA-4529]
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
[openSUSE-SU-2019:1501]
[openSUSE-SU-2019:1503]
[openSUSE-SU-2019:1572]
[openSUSE-SU-2019:1573]
[RHSA-2019:2519]
[https://bugs.php.net/bug.php?id=77831]
[[debian-lts-announce] 20190525 [SECURITY] [DLA 1803-1] php5 security update]
[20190923 [SECURITY] [DSA 4529-1] php7.0 security update]
[https://security.netapp.com/advisory/ntap-20190502-0001/]
[https://support.f5.com/csp/article/K44590877]
[USN-3953-1]
[USN-3953-2]
[DSA-4529]
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
[openSUSE-SU-2019:1501]
[openSUSE-SU-2019:1503]
[openSUSE-SU-2019:1572]
[openSUSE-SU-2019:1573]
[108177]
[RHSA-2019:2519]
[https://bugs.php.net/bug.php?id=77950]
[[debian-lts-announce] 20190525 [SECURITY] [DLA 1803-1] php5 security update]
[FEDORA-2019-6e325234a4]
[FEDORA-2019-6350c4e21a]
[FEDORA-2019-bab3944fee]
[20190920 [SECURITY] [DSA 4527-1] php7.3 security update]
[20190923 [SECURITY] [DSA 4529-1] php7.0 security update]
[https://security.netapp.com/advisory/ntap-20190517-0003/]
[USN-3566-2]
[USN-4009-1]
[DSA-4527]
[DSA-4529]
In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.
[108292]
[https://bugs.php.net/bug.php?id=77791]
[https://github.com/CVEProject/cvelist/pull/1964]
[FEDORA-2019-488d0f9a4b]
[FEDORA-2019-9448fa46f3]
[FEDORA-2019-5dc1f4100e]
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
[RHSA-2019:2519]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821]
[https://bugs.php.net/bug.php?id=77973]
[https://bugzilla.redhat.com/show_bug.cgi?id=1724149]
[https://bugzilla.redhat.com/show_bug.cgi?id=1724432]
[https://bugzilla.suse.com/show_bug.cgi?id=1140118]
[https://bugzilla.suse.com/show_bug.cgi?id=1140120]
[https://github.com/libgd/libgd/issues/501]
[[debian-lts-announce] 20190611 [SECURITY] [DLA 1817-1] libgd2 security update]
[FEDORA-2019-be4f895015]
[FEDORA-2019-8c4b25b5ec]
[20190923 [SECURITY] [DSA 4529-1] php7.0 security update]
[DSA-4529]
Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
[openSUSE-SU-2019:1778]
[RHSA-2019:2519]
[https://bugs.php.net/bug.php?id=78069]
[20190920 [SECURITY] [DSA 4527-1] php7.3 security update]
[20190923 [SECURITY] [DSA 4529-1] php7.0 security update]
[DSA-4527]
[DSA-4529]
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'.
[N/A]
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
[openSUSE-SU-2019:1778]
[RHSA-2019:2519]
[https://bugs.php.net/bug.php?id=77988]
[20190920 [SECURITY] [DSA 4527-1] php7.3 security update]
[20190923 [SECURITY] [DSA 4529-1] php7.0 security update]
[DSA-4527]
[DSA-4529]
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
[openSUSE-SU-2019:2271]
[20191008 APPLE-SA-2019-10-07-1 macOS Catalina 10.15]
[https://bugs.php.net/bug.php?id=78222]
[[debian-lts-announce] 20190812 [SECURITY] [DLA 1878-1] php5 security update]
[20191008 APPLE-SA-2019-10-07-1 macOS Catalina 10.15]
[20190920 [SECURITY] [DSA 4527-1] php7.3 security update]
[20190923 [SECURITY] [DSA 4529-1] php7.0 security update]
[https://security.netapp.com/advisory/ntap-20190822-0003/]
[https://support.apple.com/kb/HT210634]
[USN-4097-1]
[USN-4097-2]
[DSA-4527]
[DSA-4529]
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
[openSUSE-SU-2019:2271]
[20191008 APPLE-SA-2019-10-07-1 macOS Catalina 10.15]
[https://bugs.php.net/bug.php?id=78256]
[[debian-lts-announce] 20190812 [SECURITY] [DLA 1878-1] php5 security update]
[20191008 APPLE-SA-2019-10-07-1 macOS Catalina 10.15]
[20190920 [SECURITY] [DSA 4527-1] php7.3 security update]
[20190923 [SECURITY] [DSA 4529-1] php7.0 security update]
[https://security.netapp.com/advisory/ntap-20190822-0003/]
[https://support.apple.com/kb/HT210634]
[USN-4097-1]
[USN-4097-2]
[DSA-4527]
[DSA-4529]
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.
[N/A]
SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands.
[[vtigercrm-developers] 20190403 Vtiger CRM 7.1.0 (hotfix3) Released]
[https://medium.com/@mohnishdhage/sql-injection-vtiger-crm-v7-1-0-cve-2019-11057-245f84fc5c2c]
Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow.
[https://git.denx.de/?p=u-boot.git;a=commit;h=febbc583319b567fe3d83e521cc2ace9be8d1501]
[https://github.com/u-boot/u-boot/commits/master]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062, CVE-2019-1092, CVE-2019-1103, CVE-2019-1107.
[N/A]
The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time. CVSS 3.0 Base score 7.4 (Availability impacts). CVSS vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
[http://surl.twcert.org.tw/aarVJ]
[https://tvn.twcert.org.tw/taiwanvn/TVN-201906002]
[https://www.exploit-db.com/exploits/46720]
A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
[http://surl.twcert.org.tw/5df6x]
[https://github.com/tim124058/ASUS-SmartHome-Exploit/]
[https://tvn.twcert.org.tw/taiwanvn/TVN-201906003]
The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.
[http://surl.twcert.org.tw/hLFFM]
[https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0]
[https://tvn.twcert.org.tw/taiwanvn/TVN-201906001]
A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
[http://surl.twcert.org.tw/5LWQJ]
[https://github.com/tim124058/ASUS-SmartHome-Exploit/]
[https://tvn.twcert.org.tw/taiwanvn/TVN-201908014]
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator?s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.
[http://surl.twcert.org.tw/gCDQN]
[https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md]
[https://tvn.twcert.org.tw/taiwanvn/TVN-201906005]
Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
[https://github.com/gradle/gradle/pull/8927]
[FEDORA-2019-a9c15101fb]
[FEDORA-2019-902786bc1e]
[FEDORA-2019-1b6383acdd]
openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.
[https://marc.info/?l=openid-security&m=155477050605610&w=2]
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
[openSUSE-SU-2019:1433]
[openSUSE-SU-2019:1428]
[openSUSE-SU-2019:1430]
[openSUSE-SU-2019:1527]
[openSUSE-SU-2019:1824]
[[oss-security] 20190422 Nokogiri security update v1.10.3]
[[oss-security] 20190423 Re: Nokogiri security update v1.10.3]
[https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6]
[[debian-lts-announce] 20190415 [SECURITY] [DLA 1756-1] libxslt security update]
[FEDORA-2019-e21c77ffae]
[FEDORA-2019-e74d639587]
[FEDORA-2019-320d5295fc]
[USN-3947-1]
[USN-3947-2]
Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.
[https://github.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js#L158-L160]
[https://github.com/sequelize/sequelize/pull/10746/files]
[https://github.com/sequelize/sequelize/releases/tag/v5.3.0]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062, CVE-2019-1092, CVE-2019-1103, CVE-2019-1106.
[N/A]
WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.
[openSUSE-SU-2019:1374]
[openSUSE-SU-2019:1391]
[http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Code-Execution.html]
[[oss-security] 20190410 WebKitGTK and WPE WebKit Security Advisory WSA-2019-0002]
[https://bugs.webkit.org/show_bug.cgi?id=193718]
[FEDORA-2019-d9a15be3ba]
[20190411 WebKitGTK and WPE WebKit Security Advisory WSA-2019-0002]
[GLSA-201909-05]
[https://trac.webkit.org/changeset/243197/webkit]
[USN-3948-1]
SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.
[https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-10-et-SPIP-3-2-4.html]
[https://github.com/spip/SPIP/commit/3ef87c525bc0768c926646f999a54222b37b5d36]
[https://github.com/spip/SPIP/commit/824d17f424bf77d17af89c18c3dc807a3199567e]
[https://github.com/spip/SPIP/compare/1e3872c...9861a47]
[DSA-4429]
** DISPUTED ** lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit."
[107907]
[https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354]
[https://redmine.lighttpd.net/issues/2945]
Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request.
[https://docs.cribl.io/blog/release-v151]
[https://github.com/livehybrid/poc-cribl-rce]
FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI.
[http://www.iwantacve.cn/index.php/archives/191/]
MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI.
[http://www.iwantacve.cn/index.php/archives/193/]
An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its memory, aka 'Remote Desktop Protocol Client Information Disclosure Vulnerability'.
[N/A]
Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.
[http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html]
[https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes]
[https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE]
A default username and password in Dentsply Sirona Sidexis 4.2 and possibly others allows an attacker to gain administrative access to the application server.
[https://bastolino.de/sidexis4vuln.html]
core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.
[https://github.com/dkpro/dkpro-core/issues/1325]
GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies.
[https://github.com/gbraad/gauth/issues/110]
Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
[openSUSE-SU-2019:1479]
[openSUSE-SU-2019:1579]
[108488]
[RHSA-2019:1873]
[RHSA-2019:1891]
[RHSA-2019:1959]
[RHSA-2019:1971]
[https://support.f5.com/csp/article/K09376613]
[USN-4068-1]
[USN-4068-2]
[USN-4118-1]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00249.html]
A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker who successfully exploited this vulnerability could read or write information in Office documents.The security update addresses the vulnerability by correcting the way that Microsoft Office Javascript verifies trusted web pages., aka 'Microsoft Office Spoofing Vulnerability'.
[N/A]
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
[openSUSE-SU-2019:1505]
[openSUSE-SU-2019:1806]
[openSUSE-SU-2019:1805]
[http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt]
[http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en]
[RHSA-2019:1455]
[RHSA-2019:2553]
[https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf]
[https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10292]
[[debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update]
[FEDORA-2019-1f5832fc0e]
[20190624 [SECURITY] [DSA 4447-2] intel-microcode security update]
[20190624 [SECURITY] [DSA 4469-1] libvirt security update]
[USN-3977-3]
[FreeBSD-SA-19:07]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html]
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html]
Unquoted service path in the installer for the Intel(R) SCS Discovery Utility version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00234.html]
Insufficient input validation in system firmware for Intel (R) NUC Kit may allow an authenticated user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00251.html]
Insufficient access control in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable information disclosure via local access.
[https://support.f5.com/csp/article/K05525310]
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00252.html]
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1111.
[N/A]
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1110.
[N/A]
Insufficient input validation in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable denial of service via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00252.html]
Improper permissions in the installer for Intel(R) Omni-Path Fabric Manager GUI before version 10.9.2.1.1 may allow an authenticated user to potentially enable escalation of privilege via local attack.
[108788]
[https://www.intel.com/content/www/us/en/security-center/advisory/in]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00257.html]
Insufficient session validation in the service API for Intel(R) RWC3 version 4.186 and before may allow an unauthenticated user to potentially enable escalation of privilege via network access.
[108780]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00259.html]
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
[N/A]
Insufficient path checking in the installer for Intel(R) Active System Console before version 8.0 Build 24 may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00261.html]
Insufficient session validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
[108766]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129]
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
[108766]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129]
Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
[108766]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129]
Pointer corruption in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
[108766]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129]
Buffer overflow in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
[108766]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129]
Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
[108766]
[https://www.intel.com/content/www/us/en/security-center/advisory/in]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129]
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
[108766]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129]
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'.
[N/A]
Improper access control in the Intel(R) Processor Diagnostic Tool before version 4.1.2.24 may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access.
[109096]
[https://support.f5.com/csp/article/K90305959]
[https://support.f5.com/csp/article/K90305959?utm_source=f5support&utm_medium=RSS]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00268.html]
Insufficient session validation in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00272.html]
Improper permissions in the software installer for Intel(R) Authenticate before 3.8 may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00275.html]
Improper file verification in Intel? Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00276.html]
Improper file verification in Intel? Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00276.html]
Improper permissions in the installer for Intel(R) Remote Displays SDK before version 2.0.1 R2 may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00277.html]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1095, CVE-2019-1098, CVE-2019-1099, CVE-2019-1100, CVE-2019-1101.
[N/A]
Insufficient access control in hardware abstraction in SEMA driver for Intel(R) Computing Improvement Program before version 2.4.0.04733 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00283.html]
Insufficient access control in a hardware abstraction driver for Intel(R) Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00281.html]
Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable escalation of privilege via local attack.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00285.html]
Improper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access.
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00286.html]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
[N/A]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
[N/A]
A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.
[https://arxiv.org/abs/1909.04841]
[https://security.netapp.com/advisory/ntap-20190926-0001/]
[https://support.f5.com/csp/article/K43220413]
[https://support.f5.com/csp/article/K43220413?utm_source=f5support&utm_medium=RSS]
[https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00290.html]
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
[https://wordpress.org/plugins/wp-live-chat-support/#developers]
[https://wp-livechat.com/]
[https://wpvulndb.com/vulnerabilities/9320]
Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.
[https://github.com/gonicus/gosa/commits/master]
[https://lists.debian.org/debian-lts-announce/2019/08/msg00009.html]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
[N/A]
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
[openSUSE-SU-2019:1570]
[[oss-security] 20190415 Re: Linux kernel < 4.8 local generic ASLR - CVE-ID]
[107890]
[https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=a5b5352558f6808db0589644ea5401b3e3148a0d]
[https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=e1676b55d874a43646e8b2c46d87f2f3e45516ff]
[[debian-lts-announce] 20190528 [SECURITY] [DLA 1799-1] linux security update]
[[debian-lts-announce] 20190528 [SECURITY] [DLA 1799-2] linux security update]
[USN-4008-1]
[USN-4008-2]
[USN-4008-3]
[https://www.openwall.com/lists/oss-security/2019/04/03/4]
[https://www.openwall.com/lists/oss-security/2019/04/03/4/1]
** DISPUTED ** The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. NOTE: the software maintainer disputes that this is a vulnerability because ASLR for a.out format executables has never been supported.
[openSUSE-SU-2019:1570]
[[oss-security] 20190418 Re: Linux kernel < 4.8 local generic ASLR - another CVE-ID]
[[oss-security] 20190522 Re: Linux kernel < 4.8 local generic ASLR - another CVE-ID]
[107887]
[USN-4006-1]
[USN-4006-2]
[USN-4007-1]
[USN-4007-2]
[USN-4008-1]
[USN-4008-3]
[https://www.openwall.com/lists/oss-security/2019/04/03/4]
[https://www.openwall.com/lists/oss-security/2019/04/03/4/1]
The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.
[http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.html]
[https://numanozdemir.com/respdisc/directadmin.pdf]
[46694]
An authentication bypass vulnerability in all versions of ValuePLUS Integrated University Management System (IUMS) allows unauthenticated, remote attackers to gain administrator privileges via the Teachers Web Panel (TWP) User ID or Password field. If exploited, the attackers could perform any actions with administrator privileges (e.g., enumerate/delete all the students' personal information or modify various settings).
[https://blog.ziaurrashid.com/sql-injection-auth-bypass-on-iums/]
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog.
[https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20Notes]
[https://outpost24.com/blog]
Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.
[https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
[N/A]
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
[https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities]
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
[https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities]
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
[https://forums.rancher.com/c/announcements]
[https://rancher.com/docs/rancher/v2.x/en/security/]
The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and cross-site request forgery vulnerabilities. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.
[108057]
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-activematrix-bpm-2019-11203]
The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticated user to access sensitive information needed by the Spotfire Statistics Services server. The sensitive information that might be affected includes database, JMX, LDAP, Windows service account, and user credentials. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions up to and including 7.11.1; 10.0.0.
[108347]
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-statistics-services-2019-11204]
The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0, and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0.
[108384]
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11205]
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.2.0, and TIBCO Spotfire Server: versions up to and including 7.11.2; 7.12.0; 7.13.0; 7.14.0; 10.0.0; 10.0.1; 10.1.0; and 10.2.0.
[108405]
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11206]
The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attacks, as well as cross-site request forgery (CSRF) attacks. This issue affects: TIBCO Software Inc. TIBCO LogLogic Enterprise Virtual Appliance version 6.2.1 and prior versions. TIBCO Software Inc. TIBCO LogLogic Log Management Intelligence 6.2.1. TIBCO LogLogic LX825 Appliance 0.0.004, TIBCO LogLogic LX1025 Appliance 0.0.004, TIBCO LogLogic LX4025 Appliance 0.0.004, TIBCO LogLogic MX3025 Appliance 0.0.004, TIBCO LogLogic MX4025 Appliance 0.0.004, TIBCO LogLogic ST1025 Appliance 0.0.004, TIBCO LogLogic ST2025-SAN Appliance 0.0.004, and TIBCO LogLogic ST4025 Appliance 0.0.004 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below. TIBCO LogLogic LX1035 Appliance 0.0.005, TIBCO LogLogic LX1025R1 Appliance 0.0.004, TIBCO LogLogic LX1025R2 Appliance 0.0.004, TIBCO LogLogic LX4025R1 Appliance 0.0.004, TIBCO LogLogic LX4025R2 Appliance 0.0.004, TIBCO LogLogic LX4035 Appliance 0.0.005, TIBCO LogLogic ST2025-SANR1 Appliance 0.0.004, TIBCO LogLogic ST2025-SANR2 Appliance 0.0.004, TIBCO LogLogic ST2035-SAN Appliance 0.0.005, TIBCO LogLogic ST4025R1 Appliance 0.0.004, TIBCO LogLogic ST4025R2 Appliance 0.0.004, and TIBCO LogLogic ST4035 Appliance 0.0.005 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below.
[N/A]
[N/A]
The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange]
The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1; 6.1.0, TIBCO FTL Developer Edition 6.0.1; 6.1.0, and TIBCO FTL Enterprise Edition 6.0.0; 6.0.1; 6.1.0.
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-20-2019-tibco-ftl]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
[N/A]
The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an unauthenticated user to bypass access controls and remotely execute code using the operating system account hosting the affected component. This issue affects: TIBCO Enterprise Runtime for R - Server Edition versions 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.4.0 and 10.5.0.
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/09/tibco-security-advisory-september-17-2019-tibco-enterprise-runtime-for-r-server-2019-11210]
The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution in certain circumstances. When the affected component runs with the containerized TERR service on Linux the host can theoretically be tricked into running malicious code. This issue affects: TIBCO Enterprise Runtime for R - Server Edition version 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace 10.4.0; 10.5.0.
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/09/tibco-security-advisory-september-17-2019-tibco-enterprise-runtime-for-r-server-2019-11211]
The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an authenticated user with specific roles to perform cross-site scripting (XSS) attacks. This issue affects TIBCO Software Inc.'s TIBCO MDM version 9.0.1 and prior versions; version 9.1.0.
[http://www.tibco.com/services/support/advisories]
[https://www.tibco.com/support/advisories/2019/10/tibco-security-advisory-october-8-2019-tibco-mdm]
In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. (The endpoint would need to be already compromised for exploitation to succeed.) This affects Pulse Desktop Client 5.x before Secure Desktop 5.3R7 and Pulse Desktop Client 9.x before Secure Desktop 9.0R3. It also affects (for Network Connect customers) Pulse Connect Secure 8.1 before 8.1R14, 8.3 before 8.3R7, and 9.0 before 9.0R3.
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44114]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44114/]
[VU#192371]
The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server via a crafted http request.
[https://bonobogitserver.com/changelog/#version-650]
[https://flab.cesnet.cz/advisories/cve-2019-11217]
Improper handling of extra parameters in the AccountController (User Profile edit) in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows authenticated users to gain application administrator privileges via additional form parameter submissions.
[https://bonobogitserver.com/changelog/#version-650]
[https://flab.cesnet.cz/advisories/cve-2019-11218]
The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw that allows remote attackers to establish direct connections to arbitrary devices.
[https://hacked.camera/]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
[N/A]
An authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively intercept user-to-device traffic in cleartext, including video streams and device credentials.
[https://hacked.camera/]
GPAC 0.7.1 has a buffer overflow issue in gf_import_message() in media_import.c.
[https://github.com/gpac/gpac/issues/1203]
[[debian-lts-announce] 20190425 [SECURITY] [DLA 1765-1] gpac security update]
gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file.
[https://github.com/gpac/gpac/commit/f36525c5beafb78959c3a07d6622c9028de348da]
[https://github.com/gpac/gpac/issues/1204]
[https://github.com/gpac/gpac/issues/1205]
[[debian-lts-announce] 20190425 [SECURITY] [DLA 1765-1] gpac security update]
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
[https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/]
[https://wordpress.org/plugins/supportcandy/#developers]
[https://wpvulndb.com/vulnerabilities/9488]
[https://www.pluginvulnerabilities.com/2019/04/05/arbitrary-file-upload-vulnerability-in-supportcandy/]
HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection.
[https://blog.hivint.com/advisory-injection-dangerous-command-into-harman-amx-mvp5150-cve-2019-11224-55bea4a03f3e]
[https://www.amx.com/en/softwares/modero-mvp-5150-mvp-5200i-touch-panel-firmware-v2-87-13]
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
[http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html]
[20190524 CMS Made Simple 2.2.10 - (Authenticated) Persistent Cross-Site Scripting]
[https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226]
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.
[https://github.com/go-gitea/gitea/releases/tag/v1.7.6]
[https://github.com/go-gitea/gitea/releases/tag/v1.8.0-rc3]
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
[https://github.com/go-gitea/gitea/releases/tag/v1.7.6]
[https://github.com/go-gitea/gitea/releases/tag/v1.8.0-rc3]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
[N/A]
In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink. The next time the product attempts to write to the log file, the target of the symlink is renamed. This defect can be exploited to rename a critical product file (e.g., AvastSvc.exe), causing the product to fail to start on the next system restart.
[http://www.mcerlane.co.uk/CVE-2019-11230/]
[109344]
An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for example). This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to the official documentation for installation step 10, an admin is required to upload all the files, including the .htaccess files, and run a health check. However, what is overlooked is that the Apache HTTP Server by default no longer enables the AllowOverride directive, leading to data/users/admin.xml password exposure. The passwords are hashed but this can be bypassed by starting with the data/other/authorization.xml API key. This allows one to target the session state, since they decided to roll their own implementation. The cookie_name is crafted information that can be leaked from the frontend (site name and version). If a someone leaks the API key and the admin username, then they can bypass authentication. To do so, they need to supply a cookie based on an SHA-1 computation of this known information. The vulnerability exists in the admin/theme-edit.php file. This file checks for forms submissions via POST requests, and for the csrf nonce. If the nonce sent is correct, then the file provided by the user is uploaded. There is a path traversal allowing write access outside the jailed themes directory root. Exploiting the traversal is not necessary because the .htaccess file is ignored. A contributing factor is that there isn't another check on the extension before saving the file, with the assumption that the parameter content is safe. This allows the creation of web accessible and executable files with arbitrary content.
[http://packetstormsecurity.com/files/152961/GetSimpleCMS-3.3.15-Remote-Code-Execution.html]
[https://ssd-disclosure.com/?p=3899&preview=true]
EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information (Password) without being authenticated, by sending an EMP_NO element to the kws_login/asp/query_user.asp URI, and then reading the PWD element.
[https://gist.github.com/keniver/dd27ba44d0aef4318551e647d927242f]
EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGIN_ID element to the auth/main/asp/check_user_login_info.aspx URI, and then reading the response, as demonstrated by the KW_EMAIL or KW_TEL field.
[https://gist.github.com/keniver/dd27ba44d0aef4318551e647d927242f]
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
[openSUSE-SU-2019:1346]
[openSUSE-SU-2019:1394]
[RHSA-2019:1131]
[RHSA-2019:1142]
[https://bugzilla.redhat.com/show_bug.cgi?id=1695783]
[https://freeradius.org/release_notes/?br=3.0.x&re=3.0.19]
[https://freeradius.org/security/]
[https://papers.mathyvanhoef.com/dragonblood.pdf]
[USN-3954-1]
[https://www.kb.cert.org/vuls/id/871675/]
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
[openSUSE-SU-2019:1346]
[openSUSE-SU-2019:1394]
[RHSA-2019:1131]
[RHSA-2019:1142]
[https://bugzilla.redhat.com/show_bug.cgi?id=1695748]
[https://freeradius.org/release_notes/?br=3.0.x&re=3.0.19]
[https://freeradius.org/security/]
[https://papers.mathyvanhoef.com/dragonblood.pdf]
[USN-3954-1]
[https://www.kb.cert.org/vuls/id/871675/]
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
[openSUSE-SU-2019:2131]
[openSUSE-SU-2019:2133]
[RHSA-2019:2272]
[https://github.com/urllib3/urllib3/issues/1553]
[[debian-lts-announce] 20190620 [SECURITY] [DLA 1828-1] python-urllib3 security update]
[FEDORA-2019-fbda9f1e49]
[FEDORA-2019-20bc611b61]
[USN-3990-1]
[USN-3990-2]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1127, CVE-2019-1128.
[N/A]
A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter.
[https://github.com/cohesity/SecAdvisory/blob/master/README.md]
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
[108053]
[https://github.com/kubernetes/kubernetes/issues/76797]
[https://security.netapp.com/advisory/ntap-20190509-0002/]
In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
[108064]
[https://github.com/kubernetes/kubernetes/issues/76676]
[https://security.netapp.com/advisory/ntap-20190509-0002/]
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
[https://github.com/kubernetes/kubernetes/issues/78308]
[https://security.netapp.com/advisory/ntap-20190919-0003/]
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.12.9, versions prior to 1.13.6, versions prior to 1.14.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11.
[https://github.com/kubernetes/kubernetes/pull/76788]
[[ANNOUNCE] Incomplete fixes for CVE-2019-1002101, kubectl cp potential directory traversal - CVE-2019-11246]
[https://security.netapp.com/advisory/ntap-20190919-0003/]
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
[RHBA-2019:2816]
[RHBA-2019:2824]
[RHSA-2019:2690]
[https://github.com/kubernetes/kubernetes/issues/80983]
[v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249]
[https://security.netapp.com/advisory/ntap-20190919-0003/]
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
[https://github.com/kubernetes/kubernetes/issues/81023]
[CVE-2019-11248: /debug/pprof exposed on kubelet's healthz port]
[https://security.netapp.com/advisory/ntap-20190919-0003/]
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
[RHBA-2019:2794]
[RHBA-2019:2816]
[RHBA-2019:2824]
[https://github.com/kubernetes/kubernetes/issues/80984]
[v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249]
[https://security.netapp.com/advisory/ntap-20190919-0003/]
An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071, CVE-2019-1073.
[RHBA-2019:2824]
[RHSA-2019:2600]
[RHSA-2019:2609]
[RHSA-2019:2695]
[RHSA-2019:2696]
[RHSA-2019:2730]
[RHSA-2019:2899]
[RHSA-2019:2900]
[RHSA-2019:2975]
[RHSA-2019:3011]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10297]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1125]
The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
[https://github.com/kubernetes/kubernetes/issues/81114]
[https://security.netapp.com/advisory/ntap-20190919-0003/]
A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout policy.To exploit this vulnerability, an attacker could run a specially crafted application, which would allow an attacker to launch a password brute-force attack or cause account lockouts in Active Directory.This security update corrects how ADFS handles external authentication requests., aka 'ADFS Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0975.
[N/A]
Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones.
[https://www.cloudfoundry.org/blog/cve-2019-11268]
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
[http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html]
[https://pivotal.io/security/cve-2019-11269]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1128.
[N/A]
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.
[https://pivotal.io/security/cve-2019-11270]
[https://www.cloudfoundry.org/blog/cve-2019-11270]
Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.
[https://www.cloudfoundry.org/blog/cve-2019-11271]
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
[[debian-lts-announce] 20190709 [SECURITY] [DLA 1848-1] libspring-security-2.0-java security update]
[https://pivotal.io/security/cve-2019-11272]
Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and password to the billing database. A remote authenticated user with access to those logs may be able to retrieve non-sensitive information.
[https://pivotal.io/security/CVE-2019-11273]
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute.
[https://www.cloudfoundry.org/blog/cve-2019-11274]
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.
[https://pivotal.io/security/cve-2019-11275]
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent unauthenticated user could eavesdrop on the network traffic and gain access to the unencrypted token allowing the attacker to read the type of access a user has over an app. They may also modify the logging level, potentially leading to lost information that would otherwise have been logged.
[https://pivotal.io/security/cve-2019-11276]
Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack.
[https://www.cloudfoundry.org/blog/cve-2019-11277]
CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.
[https://www.cloudfoundry.org/blog/cve-2019-11278]
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
[https://www.cloudfoundry.org/blog/cve-2019-11279]
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127.
[N/A]
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.
[https://pivotal.io/security/cve-2019-11280]
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.
[N/A]
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.
[N/A]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1139, CVE-2019-1140, CVE-2019-1141, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1131]
An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap, which leads to remote code execution via shell metacharacters in a JSON value.
[https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf]
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
[N/A]
In Motorola CX2 1.01 and M2 1.01, users can access the router's /priv_mgt.html web page to launch telnetd, as demonstrated by the 192.168.51.1 address.
[https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf]
An issue was discovered in Motorola CX2 1.01 and M2 1.01. The router opens TCP port 8010. Users can send hnap requests to this port without authentication to obtain information such as the MAC addresses of connected client devices.
[https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf]
An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap, which leads to remote code execution via shell metacharacters in a JSON value.
[https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf]
HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include/types/ssl_sock.h error.
[http://git.haproxy.org/?p=haproxy.git;a=commit;h=8ef706502aa2000531d36e4ac56dbdc7c30f718d]
[https://www.mail-archive.com/haproxy@formilux.org/msg33410.html]
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
[openSUSE-SU-2019:2131]
[openSUSE-SU-2019:2133]
[[oss-security] 20190418 Re: urllib3: adds system certificates to ssl_context]
[https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4]
[USN-3990-1]
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration.
[https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/]
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can craft a special URL to read arbitrary files from the device's files system.
[https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/]
An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.
[openSUSE-SU-2019:2288]
[[oss-security] 20190516 Singularity 3.1.0: CVE-2019-11328: namespace privilege escalation and arbitrary file corruption]
[108360]
[https://github.com/sylabs/singularity/releases/tag/v3.2.0]
[FEDORA-2019-9f48c6fedc]
[FEDORA-2019-25ecc42592]
[FEDORA-2019-da2ed3b0b5]
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1194.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1133]
Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.
[108010]
[https://support.f5.com/csp/article/K09940637]
[https://support.f5.com/csp/article/K09940637?utm_source=f5support&utm_medium=RSS]
[https://tools.ietf.org/html/draft-gont-ntp-port-randomization-00]
MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which triggers e-mail transmission with the password, as demonstrated by 123456.
[https://cisk123456.blogspot.com/2019/04/mkcms-v50.html]
An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources (that are not otherwise accessible without proper authentication) via capture-replay. Physically proximate attackers can use this information to unlock unauthorized Tzumi Electronics Klic Smart Padlock Model 5686 Firmware 6.2.
[http://packetstormsecurity.com/files/153280/Tzumi-Electronics-Klic-Lock-Authentication-Bypass.html]
[https://github.com/whitehatdefenses/KlicUnLock]
Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886.
[http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html]
[20190423 Multiple vulnerabilities in Sony Smart TVs]
[108072]
[20190424 Multiple vulnerabilities in Sony Smart TVs]
[https://www.darkmatter.ae/xen1thlabs/sony-smart-tv-photo-sharing-plus-information-disclosure-vulnerability-xl-19-003/]
libavcodec/hevcdec.c in FFmpeg 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
[108034]
[https://github.com/FFmpeg/FFmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e]
[[debian-lts-announce] 20190529 [SECURITY] [DLA 1809-1] libav security update]
[20190523 [SECURITY] [DSA 4449-1] ffmpeg security update]
[USN-3967-1]
[DSA-4449]
The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
[108037]
[https://github.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb]
[https://github.com/FFmpeg/FFmpeg/commit/d227ed5d598340e719eff7156b1aa0a4469e9a6a]
[USN-3967-1]
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.
[N/A]
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.
[https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc]
[https://github.com/matrix-org/sydent/compare/7c002cd...09278fb]
[https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/]
[https://twitter.com/matrixdotorg/status/1118934335963500545]
On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge. This feature of the Service Mode application is available after entering the *#9900# check code, but is protected by an OTP password. However, this password is created locally and (due to mishandling of cryptography) can be obtained easily by reversing the password creation logic.
[https://drfone.wondershare.com/unlock/samsung-galaxy-secret-code-list.html]
[https://security.samsungmobile.com/securityUpdate.smsb]
[https://twitter.com/fs0c131y/status/1115889065285562368]
data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked.
[https://github.com/pluck-cms/pluck/issues/72]
CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page.
[https://github.com/binary1985/VulnerabilityDisclosure/blob/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure]
[https://raw.githubusercontent.com/binary1985/VulnerabilityDisclosure/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure]
[https://release-notes.cloudbees.com/release/21/8.18]
TeamSpeak 3 Client before 3.2.5 allows remote code execution in the Qt framework.
[https://forum.teamspeak.com/threads/139546-Release-TeamSpeak-3-Client-3-2-5]
[https://github.com/active-labs/Advisories/blob/master/ACTIVE-2019-004.md]
The EnGenius EWS660AP router with firmware 2.0.284 allows an attacker to execute arbitrary commands using the built-in ping and traceroute utilities by using different payloads and injecting multiple parameters. This vulnerability is fixed in a later firmware version.
[https://securityshards.wordpress.com/2019/04/21/cve-2019-11353-engenius-ews660ap-arbitrary-code-execution/]
[https://www.engeniustech.com/engenius-products/managed-outdoor-wireless-ews660ap/]
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.
[http://gamasutra.com/view/news/340907/A_nowfixed_Origin_vulnerability_potentially_opened_the_client_to_hackers.php]
[http://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.html]
[http://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-Code-Execution.html]
[https://blog.underdogsecurity.com/rce_in_origin_client/]
[https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604]
[https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/]
[https://www.golem.de/news/sicherheitsluecke-ea-origin-fuehrte-schadcode-per-link-aus-1904-140738.html]
[https://www.pcmag.com/news/367801/security-flaw-allowed-any-app-to-run-using-eas-origin-clien]
[https://www.techradar.com/news/major-security-flaw-found-in-ea-origin-gaming-client]
[https://www.thesun.co.uk/tech/8877334/sims-4-battlefield-fifa-origin-hackers/]
[https://www.trustedreviews.com/news/time-update-origin-eas-game-client-security-risk-just-installed-3697942]
[https://www.vg247.com/2019/04/17/ea-origin-security-flaw-run-malicious-code-fixed/]
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
[RHSA-2019:1771]
[FEDORA-2019-309f559057]
[FEDORA-2019-f0435555ac]
[20190609 [SECURITY] [DSA 4458-1] cyrus-imapd security update]
[https://www.cyrusimap.org/imap/download/release-notes/2.5/index.html]
[https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.html]
[https://www.cyrusimap.org/imap/download/release-notes/3.0/index.html]
[https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html]
[DSA-4458]
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
[openSUSE-SU-2019:1839]
[openSUSE-SU-2019:1872]
[http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html]
[http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html]
[20190510 dotCMS v5.1.1 Vulnerabilities]
[20190510 dotCMS v5.1.1 HTML Injection & XSS Vulnerability]
[20190510 Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability]
[[oss-security] 20190603 Django: CVE-2019-12308 AdminURLFieldWidget XSS (plus patched bundled jQuery for CVE-2019-11358)]
[108023]
[RHBA-2019:1570]
[RHSA-2019:1456]
[RHSA-2019:2587]
[RHSA-2019:3023]
[RHSA-2019:3024]
[https://backdropcms.org/security/backdrop-sa-core-2019-009]
[https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/]
[https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b]
[https://github.com/jquery/jquery/pull/4333]
[[airflow-commits] 20190428 [GitHub] [airflow] feng-tao commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358]
[[airflow-commits] 20190428 [GitHub] [airflow] XD-DENG merged pull request #5197: [AIRFLOW-XXX] Fix CVE-2019-11358]
[[airflow-commits] 20190428 [GitHub] [airflow] XD-DENG commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358]
[[airflow-commits] 20190428 [GitHub] [airflow] codecov-io commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358]
[[airflow-commits] 20190428 [GitHub] [airflow] feng-tao opened a new pull request #5197: [AIRFLOW-XXX] Fix CVE-2019-11358]
[[roller-commits] 20190820 [jira] [Created] (ROL-2150) Fix Js security vulnerabilities detected using retire js]
[[debian-lts-announce] 20190506 [SECURITY] [DLA 1777-1] jquery security update]
[[debian-lts-announce] 20190520 [SECURITY] [DLA 1797-1] drupal7 security update]
[FEDORA-2019-1a3edd7e8a]
[FEDORA-2019-eba8e44ee6]
[FEDORA-2019-7eaf0bbe7c]
[FEDORA-2019-a06dffab1c]
[FEDORA-2019-2a0ce0c58c]
[FEDORA-2019-f563e66380]
[20190421 [SECURITY] [DSA 4434-1] drupal7 security update]
[20190612 [SECURITY] [DSA 4460-1] mediawiki security update]
[20190509 dotCMS v5.1.1 Vulnerabilities]
[https://security.netapp.com/advisory/ntap-20190919-0001/]
[https://snyk.io/vuln/SNYK-JS-JQUERY-174006]
[DSA-4434]
[DSA-4460]
[https://www.drupal.org/sa-core-2019-006]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
[https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/]
Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML via the project parameter.
[https://github.com/mkucej/i-librarian/issues/138]
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.
[N/A]
A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c.
[https://0day.work/cve-2019-11360-bufferoverflow-in-iptables-restore-v1-8-2/]
[https://git.netfilter.org/iptables/commit/iptables/xshared.c?id=2ae1099a42e6a0f06de305ca13a842ac83d4683e]
app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.
[https://github.com/rocboss/ROCBOSS/issues/12]
A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary SQL commands via the AgentConsole/UserGroupQuery.php ShowUser parameter.
[https://prophecyinternational.atlassian.net/wiki/spaces/SC7/pages/158760961/Release+Notes+for+Snare+Central+v7.4.5]
An OS Command Injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to inject arbitrary OS commands via the ServerConf/DataManagement/DiskManager.php FORMNAS_share parameter.
[https://prophecyinternational.atlassian.net/wiki/spaces/SC7/pages/158760961/Release+Notes+for+Snare+Central+v7.4.5]
An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c.
[[debian-lts-announce] 20190512 [SECURITY] [DLA 1783-1] atftp security update]
[https://pulsesecurity.co.nz/advisories/atftpd-multiple-vulnerabilities]
[20190508 [SECURITY] [DSA 4438-1] atftp security update]
[https://sourceforge.net/p/atftp/code/ci/abed7d245d8e8bdfeab24f9f7f55a52c3140f96b/]
[DSA-4438]
An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.
[[debian-lts-announce] 20190512 [SECURITY] [DLA 1783-1] atftp security update]
[https://pulsesecurity.co.nz/advisories/atftpd-multiple-vulnerabilities]
[20190508 [SECURITY] [DSA 4438-1] atftp security update]
[https://sourceforge.net/p/atftp/code/ci/382f76a90b44f81fec00e2f609a94def4a5d3580/]
[DSA-4438]
An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute. By using this account and password, anyone can login successfully.
[http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.html]
[https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/view]
[https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367]
Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.
[https://drive.google.com/open?id=1X42Rdb_u4YVieXRqs0jOjyJZOb7DCJT6]
[https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11368]
An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may allow sensitive information to be read by someone with access to the device.
[https://drive.google.com/open?id=12Sq6oaxe1mC1y71Emo1YladjDjwTdNfb]
[https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11369]
A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.
[N/A]
Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.
[https://drive.google.com/open?id=1WkmtsCVNCtxwWH2fe9DtHow_Nedp1a7j]
[https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11370]
BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.
[https://github.com/lh3/bwa/issues/239]
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
[openSUSE-SU-2019:1629]
[openSUSE-SU-2019:1658]
[openSUSE-SU-2019:1889]
[https://github.com/MediaArea/MediaInfoLib/pull/1111]
[FEDORA-2019-79cb2bb18e]
[FEDORA-2019-9d1e542c57]
[FEDORA-2019-e640b27e7e]
[FEDORA-2019-b7cf3236fb]
[FEDORA-2019-1736c1268d]
[FEDORA-2019-7155125125]
[https://sourceforge.net/p/mediainfo/bugs/1101/]
[USN-3988-1]
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
[openSUSE-SU-2019:1629]
[openSUSE-SU-2019:1658]
[openSUSE-SU-2019:1889]
[https://github.com/MediaArea/MediaInfoLib/pull/1111]
[FEDORA-2019-79cb2bb18e]
[FEDORA-2019-9d1e542c57]
[FEDORA-2019-e640b27e7e]
[FEDORA-2019-b7cf3236fb]
[FEDORA-2019-1736c1268d]
[FEDORA-2019-7155125125]
[https://sourceforge.net/p/mediainfo/bugs/1101/]
[USN-3988-1]
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
[http://packetstormsecurity.com/files/152603/74CMS-5.0.1-Cross-Site-Request-Forgery.html]
[http://www.iwantacve.cn/index.php/archives/203/]
[46738]
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.
[http://packetstormsecurity.com/files/152604/Msvod-10-Cross-Site-Request-Forgery.html]
[http://www.iwantacve.cn/index.php/archives/198/]
[46739]
** DISPUTED ** SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own."
[http://www.iwantacve.cn/index.php/archives/212/]
[https://github.com/inunosinsi/soycms/issues/5]
wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fm_get_text_exts function.
[http://www.iwantacve.cn/index.php/archives/208/]
[https://github.com/vedees/wcms/issues/2]
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
[108069]
[https://github.com/projectsend/projectsend/issues/700]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1217, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1138]
The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via a com.estrongs.android.pop.ftp.ESFtpShortcut intent, leading to remote FTP access to the entirety of local storage.
[https://medium.com/@bhaveshthakur2015/cve-2019-11380-how-i-was-able-to-access-complete-storage-of-es-fileexplorer-end-user-9bd8da5ac3b8]
An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android. An attacker can read the username/password of a valid user via /data/data/com.medhaapps.wififtpserver/shared_prefs/com.medhaapps.wififtpserver_preferences.xml
[https://pastebin.com/6uT9jhDR]
The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e. plain text), which allows a non-root user to find out the username/password of a valid user via /data/data/com.zalora.android/shared_prefs/login_data.xml.
[https://pastebin.com/c90h9WfB]
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators.
[https://coreruleset.org/20190627/announcement-owasp-modsecurity-core-rule-set-version-3-1-1/]
[https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.1/dev/CHANGES]
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1359]
** DISPUTED ** An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity.
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1354]
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1372]
** DISPUTED ** An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with next# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity.
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1356]
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1372]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1140, CVE-2019-1141, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1139]
** DISPUTED ** An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with set_error_handler# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity.
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1358]
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1372]
** DISPUTED ** An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with $a# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity.
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1357]
[https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1372]
BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.
[https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks]
An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter.
[https://mmonit.com/wiki/MMonit/Release3-7-3]
[https://www.exploit-db.com/exploits/46404]
A buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long string, as demonstrated by SMTP RCPT TO, POP3 USER, POP3 LIST, POP3 TOP, or POP3 RETR.
[http://packetstormsecurity.com/files/152502/MailCarrier-2.51-RCPT-TO-Buffer-Overflow.html]
[http://packetstormsecurity.com/files/152504/MailCarrier-2.51-USER-Buffer-Overflow.html]
[http://packetstormsecurity.com/files/152505/MailCarrier-2.51-LIST-Buffer-Overflow.html]
[http://packetstormsecurity.com/files/152506/MailCarrier-2.51-TOP-Buffer-Overflow.html]
[http://packetstormsecurity.com/files/152530/MailCarrier-2.51-RETR-Buffer-Overflow.html]
[https://packetstormsecurity.com/files/152502/MailCarrier-2.51-RCPT-TO-Buffer-Overflow.html]
[https://packetstormsecurity.com/files/152504/MailCarrier-2.51-USER-Buffer-Overflow.html]
[https://packetstormsecurity.com/files/152505/MailCarrier-2.51-LIST-Buffer-Overflow.html]
[https://packetstormsecurity.com/files/152506/MailCarrier-2.51-TOP-Buffer-Overflow.html]
[https://packetstormsecurity.com/files/152530/MailCarrier-2.51-RETR-Buffer-Overflow.html]
An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder (files / folders and configuration) are incompatible with the privileged file manipulation performed by the product. Files can be created that can be used by an unprivileged user to obtain SYSTEM privileges. Arbitrary file creation can be achieved by abusing the SwuConfig.json file creation: an unprivileged user can replace these files by pseudo-symbolic links to arbitrary files. When an update occurs, a privileged service creates a file and sets its access rights, offering write access to the Everyone group in any directory.
[http://packetstormsecurity.com/files/153868/Avira-Free-Security-Suite-2019-Software-Updater-2.0.6.13175-Improper-Access-Control.html]
[https://medium.com/sidechannel-br/vulnerabilidade-no-avira-security-suite-pode-levar-%C3%A0-escala%C3%A7%C3%A3o-de-privil%C3%A9gios-no-windows-71964236c077]
[20190802 Avira Free Security Suite 2019 - Exploiting Arbitrary File Writes for Local Elevation of Privilege]
GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc parameter.
[http://rapidflows.com/]
[https://medium.com/@javarmutt/rapid4-local-file-inclusion-0day-151c830ac74a]
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.
[http://packetstormsecurity.com/files/153219/UliCMS-2019.1-Cross-Site-Scripting.html]
[https://en.ulicms.de/]
[https://www.exploit-db.com/exploits/46741/]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1141, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1140]
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.
[https://github.com/siteserver/cms/issues/1858]
In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format.
[https://gradle.com/enterprise/releases/2018.5/#changes-3]
In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page.
[https://gradle.com/enterprise/releases/2018.5/#changes-2]
arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.
[https://github.com/arrow-kt/ank/issues/35]
[https://github.com/arrow-kt/ank/pull/36]
[https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8]
[https://github.com/arrow-kt/arrow/issues/1310]
[https://github.com/arrow-kt/arrow/releases/tag/0.9.0]
OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecurely resolved dependencies.
[https://github.com/OpenAPITools/openapi-generator/issues/2253]
[https://github.com/OpenAPITools/openapi-generator/pull/2248]
[https://github.com/OpenAPITools/openapi-generator/pull/2697]
Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.
[https://github.com/intelliants/subrion/commits/develop]
[https://github.com/intelliants/subrion/issues/821]
app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information.
[https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html]
[https://github.com/fusionpbx/fusionpbx/commit/f38676b7b63bb1ec3a68d577fe23e6701f482aef]
XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number. This can further lead to remote code execution by chaining this vulnerability with a command injection vulnerability also present in FusionPBX.
[http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.html]
[https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html]
[https://github.com/fusionpbx/fusionpbx/commit/391a23d070f3036d0c7760992f6970b0a76ee4d7]
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
[http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.html]
[https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html]
[https://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611]
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1140, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1141]
app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute commands on the host.
[https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html]
[https://github.com/fusionpbx/fusionpbx/commit/0f965c89288de449236ad6de4f97960814ce8c84]
An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer overflow.
[http://www.ghostscript.com/cgi-bin/findgit.cgi?da632ca08f240590d2dec786722ed08486ce1be6]
[108093]
[https://bugs.ghostscript.com/show_bug.cgi?id=700938]
[https://github.com/ccxvii/mujs/commit/da632ca08f240590d2dec786722ed08486ce1be6]
An issue was discovered in Artifex MuJS 1.0.5. jscompile.c can cause a denial of service (invalid stack-frame jump) because it lacks an ENDTRY opcode call.
[http://www.ghostscript.com/cgi-bin/findgit.cgi?1e5479084bc9852854feb1ba9bf68b52cd127e02]
[108093]
[https://bugs.ghostscript.com/show_bug.cgi?id=700947]
[https://github.com/ccxvii/mujs/commit/1e5479084bc9852854feb1ba9bf68b52cd127e02]
An issue was discovered in Artifex MuJS 1.0.5. It has unlimited recursion because the match function in regexp.c lacks a depth check.
[http://www.ghostscript.com/cgi-bin/findgit.cgi?00d4606c3baf813b7b1c176823b2729bf51002a2]
[108093]
[https://bugs.ghostscript.com/show_bug.cgi?id=700937]
[https://github.com/ccxvii/mujs/commit/00d4606c3baf813b7b1c176823b2729bf51002a2]
An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete control of the router.
[http://1.337.zone/2019/04/07/intelbras-iwr-3000n-1-5-0-unproper-de-authorization/]
An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows remote attackers to cause a denial of service (reboot), as demonstrated by JSON misparsing of the \""} string to v1/system/login.
[http://packetstormsecurity.com/files/152680/Intelbras-IWR-3000N-Denial-Of-Service.html]
[https://1.337.zone/2019/04/08/intelbras-iwr-3000n-any-version-dos-on-malformed-login-request/]
[46768]
A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstrated by v1/system/user.
[http://packetstormsecurity.com/files/152682/Intelbras-IWR-3000N-1.5.0-Cross-Site-Request-Forgery.html]
[https://1.337.zone/2019/04/08/intelbras-iwr-3000n-1-5-0-csrf-lead-to-router-takeover/]
[46770]
system.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source-length check before a strcpy operation in the respondAsp function. Attackers can exploit the vulnerability by using the languse parameter with a long string. This affects 1.2.2 build 28, 64, 65, and 68.
[https://github.com/zyw-200/IOTFuzzer/blob/master/Trendnet_response.png]
apply.cgi on the TRENDnet TEW-632BRP 1.010B32 router has a buffer overflow via long strings to the SOAPACTION:HNAP1 interface.
[https://github.com/zyw-200/IOTFuzzer/blob/master/Trendnet_response.png]
vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash) by replacing an emoji file (under the /sdcard/tencent/MicroMsg directory) with a crafted .wxgf file. The content of the replacement must be derived from the phone's IMEI. The crash occurs upon receiving a message that contains the replaced emoji.
[http://packetstormsecurity.com/files/152947/WeChat-7.0.4-Denial-Of-Service.html]
[https://awakened1712.github.io/hacking/hacking-wechat-dos/]
[46853]
An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET Framework Elevation of Privilege Vulnerability'.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1142]
An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter.
[https://github.com/idreamsoft/iCMS/issues/64]
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter.
[https://github.com/idreamsoft/iCMS/issues/64]
I, Librarian 4.10 has XSS via the export.php export_files parameter.
[https://github.com/mkucej/i-librarian/issues/139]
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.
[http://packetstormsecurity.com/files/152696/CentOS-Web-Panel-Domain-Field-Cross-Site-Scripting.html]
[https://CentOS-WebPanel.com]
[46784]
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Graphics Component Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1154, CVE-2019-1158.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1143]
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microsoft Graphics Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1145, CVE-2019-1149, CVE-2019-1150, CVE-2019-1151, CVE-2019-1152.
[http://packetstormsecurity.com/files/154085/Microsoft-Font-Subsetting-DLL-MergeFormat12Cmap-MakeFormat12MergedGlyphList-Double-Free.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1144]
** DISPUTED ** An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortlet_script value to group/control_panel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw.
[https://dev.liferay.com/discover/portal/-/knowledge_base/7-1/running-scripts-from-the-script-console]
[https://pentest.com.tr/exploits/Liferay-CE-Portal-Tomcat-7-1-2-ga3-Groovy-Console-Remote-Command-Execution-Metasploit.html]
[https://www.exploit-db.com/exploits/46525]
OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.
[https://pentest.com.tr/exploits/OpenKM-DM-6-3-7-Remote-Command-Execution-Metasploit.html]
[https://www.exploit-db.com/exploits/46526]
An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml.
[http://pentest.com.tr/exploits/ATutor-2-2-4-file-manager-Remote-Code-Execution-Injection-Metasploit.html]
[46691]
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
[http://pentest.com.tr/exploits/CuteNews-2-1-2-Remote-Code-Execution-Metasploit.html]
[46698]
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.
[https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html]
[https://www.exploit-db.com/exploits/46725]
[46725]
[https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html]
I, Librarian 4.10 has XSS via the notes.php notes parameter.
[https://github.com/mkucej/i-librarian/issues/140]
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microsoft Graphics Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1144, CVE-2019-1149, CVE-2019-1150, CVE-2019-1151, CVE-2019-1152.
[http://packetstormsecurity.com/files/154081/Microsoft-Font-Subsetting-DLL-MergeFontPackage-Dangling-Pointer.html]
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1145]
whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.
[https://github.com/kikulo/DebugOpen/blob/master/whatsns4.0/Main.md]
whatsns 4.0 allows index.php?inform/add.html qid SQL injection.
[https://github.com/kikulo/DebugOpen/blob/master/whatsns4.0/Main.md]
whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.
[https://github.com/kikulo/DebugOpen/blob/master/whatsns4.0/Main.md]
Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.
[https://bitbucket.org/tildeslash/monit/commits/1a8295eab6815072a18019b668fe084945b751f3]
[https://bitbucket.org/tildeslash/monit/commits/328f60773057641c4b2075fab9820145e95b728c]
[https://github.com/dzflack/exploits/blob/master/unix/monit_xss.py]
[[debian-lts-announce] 20190426 [SECURITY] [DLA 1767-1] monit security update]
[USN-3971-1]
A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service (application outage).
[https://bitbucket.org/tildeslash/monit/commits/f12d0cdb42d4e74dffe1525d4062c815c48ac57a]
[https://github.com/dzflack/exploits/blob/master/macos/monit_dos.py]
[https://github.com/dzflack/exploits/blob/master/unix/monit_buffer_overread.py]
[[debian-lts-announce] 20190426 [SECURITY] [DLA 1767-1] monit security update]
[USN-3971-1]
Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.
[https://cisk123456.blogspot.com/2019/04/gila-cms-1101-csrf.html]
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.
[http://packetstormsecurity.com/files/154219/Django-CRM-0.2.1-Cross-Site-Request-Forgery.html]
[20190827 Multiple CSRF Vulnerabilities in Django CRM 0.2.1]
[https://www.netsparker.com/blog/web-security/]
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
[https://bakery.cakephp.org/2019/04/23/cakephp_377_3615_3518_released.html]
[https://github.com/cakephp/cakephp/commit/1a74e798309192a9895c9cedabd714ceee345f4e]
[https://github.com/cakephp/cakephp/commits/master]
[https://github.com/cakephp/cakephp/compare/3.7.6...3.7.7]
[https://github.com/cakephp/cakephp/releases]
The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.
[openSUSE-SU-2019:1667]
[https://gitlab.gnome.org/GNOME/evince/issues/1129]
[[debian-lts-announce] 20190813 [SECURITY] [DLA 1881-1] evince security update]
[[debian-lts-announce] 20190813 [SECURITY] [DLA 1882-1] atril security update]
[FEDORA-2019-6316c0663e]
[FEDORA-2019-ff2b5b5b47]
[USN-3959-1]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1147, CVE-2019-1155, CVE-2019-1156, CVE-2019-1157.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1146]
An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.
[openSUSE-SU-2019:2038]
[https://gitlab.gnome.org/GNOME/gnome-desktop/issues/112]
[FEDORA-2019-992622684b]
[GLSA-201908-28]
[USN-3994-1]
An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.
[openSUSE-SU-2019:2038]
[https://gitlab.gnome.org/GNOME/nautilus/issues/987]
[GLSA-201908-27]
A memory leak in archive_read_format_zip_cleanup in archive_read_support_format_zip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVE_LZMA_H typo. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.
[MISC]
[https://github.com/libarchive/libarchive/commit/ba641f73f3d758d9032b3f0e5597a9c6e593a505]
[https://github.com/libarchive/libarchive/issues/1165]
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection, which are more generally applicable to HTML endpoint, to be included too. These headers were not included in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Server Views REST API (port 8092).
[https://www.couchbase.com/resources/security#SecurityAlerts]
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even if the log was redacted for privacy. This has been fixed (in 5.5.4 and 6.0.1) so that usernames are tagged properly in the logs and are hashed out when the logs are redacted.
[https://www.couchbase.com/resources/security#SecurityAlerts]
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.
[https://www.couchbase.com/resources/security#SecurityAlerts]
In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ensure buffer always grows as needed for any input.
[https://www.couchbase.com/resources/security#SecurityAlerts]
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.
[http://packetstormsecurity.com/files/152607/ManageEngine-Applications-Manager-14.0-SQL-Injection-Command-Injection.html]
[https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-Auth-Bypass-Remote-Command-Execution.html]
[https://www.exploit-db.com/exploits/46740]
[46740]
[https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11469.html]
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1146, CVE-2019-1155, CVE-2019-1156, CVE-2019-1157.
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1147]
The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
[openSUSE-SU-2019:1603]
[openSUSE-SU-2019:1683]
[https://github.com/ImageMagick/ImageMagick/commit/e3cdce6fe12193f235b8c0ae5efe6880a25eb957]
[https://github.com/ImageMagick/ImageMagick/issues/1472]
[FEDORA-2019-da4c20882c]
[FEDORA-2019-425a1aa7c9]
[USN-4034-1]
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.
[https://github.com/strukturag/libheif/commit/995a4283d8ed2d0d2c1ceb1a577b993df2f0e014]
[https://github.com/strukturag/libheif/issues/123]
ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.
[openSUSE-SU-2019:1603]
[openSUSE-SU-2019:1683]
[https://github.com/ImageMagick/ImageMagick/issues/1546]
[https://github.com/ImageMagick/ImageMagick6/commit/f663dfb8431c97d95682a2b533cca1c8233d21b4]
[FEDORA-2019-da4c20882c]
[FEDORA-2019-425a1aa7c9]
[USN-4034-1]
coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to cause a denial of service (out-of-bounds read and application crash) by crafting an XWD image file, a different vulnerability than CVE-2019-11008 and CVE-2019-11009.
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/5402c5cbd8bd]
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/944dcbc457f8]
[openSUSE-SU-2019:1354]
[openSUSE-SU-2019:1355]
[openSUSE-SU-2019:1437]
[http://www.graphicsmagick.org/Changelog.html]
[108055]
[[debian-lts-announce] 20190520 [SECURITY] [DLA 1795-1] graphicsmagick security update]
[FEDORA-2019-da4c20882c]
[FEDORA-2019-425a1aa7c9]
coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to cause a denial of service (floating-point exception and application crash) by crafting an XWD image file, a different vulnerability than CVE-2019-11008 and CVE-2019-11009.
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/5402c5cbd8bd]
[http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/944dcbc457f8]
[openSUSE-SU-2019:1354]
[openSUSE-SU-2019:1355]
[openSUSE-SU-2019:1437]
[http://www.graphicsmagick.org/Changelog.html]
[108055]
[[debian-lts-announce] 20190520 [SECURITY] [DLA 1795-1] graphicsmagick security update]
[FEDORA-2019-da4c20882c]
[FEDORA-2019-425a1aa7c9]
An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap allocated buffer when processing large crash dumps. This results in a crash or possible code-execution in the context of the whoopsie process.
[https://bugs.launchpad.net/ubuntu/%2Bsource/whoopsie/%2Bbug/1830863]
[https://usn.ubuntu.com/4052-1/]
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.
[http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html]
[[oss-security] 20190620 Re: Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service issues]
[[oss-security] 20190628 Re: linux-distros membership application - Microsoft]
[[oss-security] 20190706 Re: linux-distros membership application - Microsoft]
[[oss-security] 20190706 Re: linux-distros membership application - Microsoft]
[http://www.vmware.com/security/advisories/VMSA-2019-0010.html]
[RHSA-2019:1594]
[RHSA-2019:1602]
[RHSA-2019:1699]
[https://access.redhat.com/security/vulnerabilities/tcpsack]
[https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf]
[https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=3b4929f65b0d8249f19a50245cd88ed1a2f78cff]
[https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10287]
[https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0006]
[https://security.netapp.com/advisory/ntap-20190625-0001/]
[https://support.f5.com/csp/article/K78234183]
[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic]
[VU#905115]
[https://www.synology.com/security/advisory/Synology_SA_19_28]
[https://www.us-cert.gov/ics/advisories/icsa-19-253-03]
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
[http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html]
[http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html]
[[oss-security] 20190628 Re: linux-distros membership application - Microsoft]
[[oss-security] 20190706 Re: linux-distros membership application - Microsoft]
[[oss-security] 20190706 Re: linux-distros membership application - Microsoft]
[http://www.vmware.com/security/advisories/VMSA-2019-0010.html]
[RHSA-2019:1594]
[RHSA-2019:1602]
[RHSA-2019:1699]
[https://access.redhat.com/security/vulnerabilities/tcpsack]
[https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf]
[https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=f070ef2ac66716357066b683fb0baf55f8191a2e]
[https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10287]
[https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0007]
[20190722 [SECURITY] [DSA 4484-1] linux security update]
[https://security.netapp.com/advisory/ntap-20190625-0001/]
[https://support.f5.com/csp/article/K26618426]
[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic]
[VU#905115]
[https://www.synology.com/security/advisory/Synology_SA_19_28]
[https://www.us-cert.gov/ics/advisories/icsa-19-253-03]