Archive
22 April 2019
Vulnerabilities first published on this day (UTC), newest first.
52 results · Feed
-
Unscored —CVE-2019-8452 Public exploit
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clie…
-
Unscored —
A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony ma…
-
Unscored —
An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android. An attacker can read the username/p…
-
Unscored —
The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e. plain text), w…
-
High 7.5CVE-2019-5427 Public exploit
Billion laughs attack in c3p0
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
-
Unscored —
An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may …
-
Unscored —
An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A co…
-
Unscored —
The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince thr…
-
High 8.1
Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS
Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be i…
-
Medium 6.1
Cross-site Scripting in Eclipse Jetty
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a List…
-
Medium 5.3
Installation information leak in Eclipse Jetty
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error …
-
Medium 5.3
Information Exposure vulnerability in Eclipse Jetty
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. T…
-
Unscored —
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, …
-
High 7.0
chmod race in doUidshiftIntoContainer
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's cho…
-
Medium 5.5
Probe-and-enlist for SeaMicro chassis writes password to the log
The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
-
High 7.4
Apport privilege escalation through Python module imports
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.
-
Medium 6.4
Juju Joyent provider uploads user's private ssh key by default
Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
-
Medium 5.7
python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
-
Low 3.9
Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access
Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS …
-
Low 2.0
unity-scope-gdrive search feature logs search terms to syslog
All versions of unity-scope-gdrive logs search terms to syslog.
-
Low 2.0
uuid.uuid1() is not suitable as an unguessable identifier/token
A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affects Ubuntu MAAS versions prior to 1.9.2.
-
Critical 9.6
MAAS API vulnerable to CSRF attack
A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MAAS versions prior to 1.9.2.
-
Medium 6.7
UDM doesn't check for confinement before running post-processing commands
UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confine…
-
Medium 4.8
Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash
Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a scope.
-
Low 3.9
AppArmor mount rules grant excessive permissions
In all versions of AppArmor mount rules are accidentally widened when compiled.
-
Low 1.8
A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for…
-
High 7.1
The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controllin…
-
Low 1.6
Unity8 converged application lifecycle allows background applications to use on-screen keyboard when not top-most
In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consume keyboard input.
-
Medium 5.7
Ekiga attempts to dlopen /tmp/ekiga_test.so
Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekiga_test.so.
-
Low 3.8
mount.ecrpytfs_private sets group owner of /etc/mtab to user's primary group
When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So when it creates the new version, mtab.tmp, it's created with the group id of the user running mount.ecryptfs_private.
-
Low 2.8
qcow format could expose host filesystem information
Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.
-
Medium 5.2
SELinux initscript misuse of touch
The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.
-
High 8.6
get_file_by_name does not check owner
A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS versions prior to 1.9.2.
-
Unscored —
Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.
-
Medium 5.1
Mercurial Path Traversal/Link Following vulnerability
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
-
Medium 5.6
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…
-
Medium 4.1
A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM B…
-
Medium 6.5
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data captur…
-
High 7.3
It was found that default configuration of Heketi does not require any authentication potentially exposing the manageme…
-
Unscored —
A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker…