Security News

CVE-2019-9700

National Vulnerability Database - Tue, 07/16/2019 - 15:15
Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic.
Categories: Security News

CVE-2019-12990

National Vulnerability Database - Tue, 07/16/2019 - 14:15
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
Categories: Security News

CVE-2019-12991

National Vulnerability Database - Tue, 07/16/2019 - 14:15
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
Categories: Security News

CVE-2019-12992

National Vulnerability Database - Tue, 07/16/2019 - 14:15
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6).
Categories: Security News

CVE-2019-13115

National Vulnerability Database - Tue, 07/16/2019 - 14:15
In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds write in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.
Categories: Security News

CVE-2019-13359

National Vulnerability Database - Tue, 07/16/2019 - 14:15
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.
Categories: Security News

CVE-2019-10190

National Vulnerability Database - Tue, 07/16/2019 - 14:15
A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191.
Categories: Security News

CVE-2019-10191

National Vulnerability Database - Tue, 07/16/2019 - 14:15
A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.
Categories: Security News

CVE-2019-12834

National Vulnerability Database - Tue, 07/16/2019 - 14:15
In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATH_INFO to the dashboards/ URI.
Categories: Security News

CVE-2019-12985

National Vulnerability Database - Tue, 07/16/2019 - 14:15
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6).
Categories: Security News

CVE-2019-12986

National Vulnerability Database - Tue, 07/16/2019 - 14:15
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6).
Categories: Security News

CVE-2019-12987

National Vulnerability Database - Tue, 07/16/2019 - 14:15
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
Categories: Security News

CVE-2019-12988

National Vulnerability Database - Tue, 07/16/2019 - 14:15
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).
Categories: Security News

CVE-2019-12989

National Vulnerability Database - Tue, 07/16/2019 - 14:15
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
Categories: Security News

CVE-2018-13442

National Vulnerability Database - Tue, 07/16/2019 - 14:15
SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter.
Categories: Security News

CVE-2019-13360

National Vulnerability Database - Tue, 07/16/2019 - 13:15
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.
Categories: Security News

CVE-2019-13383

National Vulnerability Database - Tue, 07/16/2019 - 13:15
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.
Categories: Security News

CVE-2019-13603

National Vulnerability Database - Tue, 07/16/2019 - 13:15
An issue was discovered in the HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader Windows Biometric Framework driver 5.0.0.5. It has a statically coded initialization vector to encrypt a user's fingerprint image, resulting in weak encryption of that. This, in combination with retrieving an encrypted fingerprint image and encryption key (through another vulnerability), allows an attacker to obtain a user's fingerprint image.
Categories: Security News

CVE-2019-13605

National Vulnerability Database - Tue, 07/16/2019 - 13:15
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.
Categories: Security News

CVE-2019-13615

National Vulnerability Database - Tue, 07/16/2019 - 13:15
VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.
Categories: Security News

Pages