Security News

CVE-2018-2021 (qradar_security_information_and_event_manager)

National Vulnerability Database - Wed, 07/17/2019 - 10:15
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155345.
Categories: Security News

CVE-2018-2022 (qradar_security_information_and_event_manager)

National Vulnerability Database - Wed, 07/17/2019 - 10:15
IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 155346.
Categories: Security News

CVE-2019-1010083

National Vulnerability Database - Wed, 07/17/2019 - 10:15
The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1.
Categories: Security News

CVE-2019-1010084

National Vulnerability Database - Wed, 07/17/2019 - 10:15
Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is: Incorrect calls to _ensure_auth() wrapper result in authentication-checking not being applied to al routes.
Categories: Security News

CVE-2019-4054 (qradar_security_information_and_event_manager)

National Vulnerability Database - Wed, 07/17/2019 - 10:15
IBM QRadar SIEM 7.2 and 7.3 could allow a local user to obtain sensitive information when exporting content that could aid an attacker in further attacks against the system. IBM X-Force ID: 156563.
Categories: Security News

CVE-2019-4194

National Vulnerability Database - Wed, 07/17/2019 - 10:15
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authorized resources. IBM X-Force ID: 159033.
Categories: Security News

CVE-2019-13272

National Vulnerability Database - Wed, 07/17/2019 - 09:15
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME.
Categories: Security News

CVE-2019-13446

National Vulnerability Database - Wed, 07/17/2019 - 08:15
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Categories: Security News

CVE-2019-9848

National Vulnerability Database - Wed, 07/17/2019 - 08:15
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
Categories: Security News

CVE-2019-9849

National Vulnerability Database - Wed, 07/17/2019 - 08:15
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
Categories: Security News

Vuln: Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability

SecurityFocus Vulnerabilities - Wed, 07/17/2019 - 00:00
Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability
Categories: Security News

Vuln: Apache Tomcat CVE-2018-1305 Security Bypass Vulnerability

SecurityFocus Vulnerabilities - Wed, 07/17/2019 - 00:00
Apache Tomcat CVE-2018-1305 Security Bypass Vulnerability
Categories: Security News

Vuln: Apache HTTP Server CVE-2019-0190 Denial of Service Vulnerability

SecurityFocus Vulnerabilities - Wed, 07/17/2019 - 00:00
Apache HTTP Server CVE-2019-0190 Denial of Service Vulnerability
Categories: Security News

Vuln: Novell NetIQ Sentinel CVE-2016-1000031 Remote Code Execution Vulnerability

SecurityFocus Vulnerabilities - Wed, 07/17/2019 - 00:00
Novell NetIQ Sentinel CVE-2016-1000031 Remote Code Execution Vulnerability
Categories: Security News

CVE-2019-13623

National Vulnerability Database - Tue, 07/16/2019 - 23:15
In NSA Ghidra through 9.0.4, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.
Categories: Security News

CVE-2019-13624

National Vulnerability Database - Tue, 07/16/2019 - 23:15
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.
Categories: Security News

CVE-2019-13625

National Vulnerability Database - Tue, 07/16/2019 - 23:15
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
Categories: Security News

CVE-2019-3571

National Vulnerability Database - Tue, 07/16/2019 - 17:15
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
Categories: Security News

A proactive approach to more secure code

Security Research & Defense - Tue, 07/16/2019 - 16:49
What if we could eliminate an entire class of vulnerabilities before they ever happened? Since 2004, the Microsoft Security Response Centre (MSRC) has triaged every reported Microsoft security vulnerability. From all that triage one astonishing fact sticks out: as Matt Miller discussed in his 2019 presentation at BlueHat IL, the majority of vulnerabilities fixed and …

A proactive approach to more secure code Read More »

Categories: Security News

CVE-2019-6160

National Vulnerability Database - Tue, 07/16/2019 - 15:15
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.
Categories: Security News

Pages