CVSS: 5.3EPSS: 0%CPEs: 33EXPL: 0CVE-2019-2762 – OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)
https://notcve.org/view.php?id=CVE-2019-2762
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://access.redhat.com/errata/RHSA-2019:2494 https://access.redhat.com/errata/RHSA-2019:2495 https://access.redhat.com/errata/RHSA-2019:2585 https://access.redhat.com/errata/RHSA-2019:2590 https://access.redhat.com/errata/RHSA-2019:2592 https://access.redhat.com •
CVSS: 3.4EPSS: 0%CPEs: 23EXPL: 0CVE-2019-2786 – OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)
https://notcve.org/view.php?id=CVE-2019-2786
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://access.redhat.com/errata/RHSA-2019:2585 https://access.redhat.com/errata/RHSA-2019:2590 https://access.redhat.com/errata/RHSA-2019:2592 https://access.redhat.com/errata/RHSA-2019:2737 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_ •
CVSS: 7.1EPSS: 0%CPEs: 10EXPL: 0CVE-2019-11989
https://notcve.org/view.php?id=CVE-2019-11989
A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA (Agent module ) could be exploited remotely to cause a denial of service. The versions and platforms of Agent Option modules that are impacted are as follows: 10.0 for Apache 2.2 on RHEL 5 and 6, 10.0 for Apache 2.4 on RHEL 7, 10.0 for Apache 2.4 on HP-UX 11i v3, 10.0 for IIS on Windows, 11.0 for Apache 2.4 on RHEL 7, MFA Proxy 4.0 (Agent module only) for Apache 2.4 on RHEL 7. Una vulnerabilidad de seguridad en IceWall SSO Agent Option y IceWall MFA (módulo Agent) de HPE podría ser explotada remotamente para causar una denegación de servicio. Las versiones y plataformas de los módulos Agent Option que están afectadas son las siguientes: versión 10.0 para Apache versión 2.2 en RHEL versiones 5 y 6.0, versión 10.0 para Apache versión 2.4 en RHEL versión 7, versión 10.0 para Apache versión 2.4 en HP-UX 11i versión v3, versión 10.0 para IIS en Windows, versión 11.0 para Apache versión 2.4 en RHEL versión 7, MFA Proxy versión 4.0 (solo módulo Agent) para Apache versión 2.4 en RHEL versión 7. • https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03941en_us •
CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 0CVE-2019-10168 – libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs
https://notcve.org/view.php?id=CVE-2019-10168
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Las APIs libvirt de las funciones virConnectBaselineHypervisorCPU() y virConnectCompareHypervisorCPU(), versiones 4.x.x anteriores a 4.10.1 y versiones 5.x.x anteriores a 5.4.1, aceptan un argumento "emulator" para especificar el programa que proporciona emulación para un dominio. Desde versión v1.2.19, libvirt ejecutará ese programa para examinar las capacidades del dominio. • https://access.redhat.com/libvirt-privesc-vulnerabilities https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10168 https://security.gentoo.org/glsa/202003-18 https://access.redhat.com/security/cve/CVE-2019-10168 https://bugzilla.redhat.com/show_bug.cgi?id=1720118 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-250: Execution with Unnecessary Privileges CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2019-10166 – libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients
https://notcve.org/view.php?id=CVE-2019-10166
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. Se detectó que libvirtd, versiones 4.x.x anteriores a 4.10.1 y versiones 5.x.x anteriores a 5.4.1, permitiría a los clientes de solo lectura utilizar la API de la función virDomainManagedSaveDefineXML(), lo que les permitiría modificar archivos de estado managed save. Si un managed save ya ha sido creado por un usuario privilegiado, un atacante local podría modificar este archivo de manera que libvirtd ejecutaría un programa arbitrario cuando el dominio esté reanudado. It was discovered that libvirtd would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. • https://access.redhat.com/libvirt-privesc-vulnerabilities https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10166 https://security.gentoo.org/glsa/202003-18 https://access.redhat.com/security/cve/CVE-2019-10166 https://bugzilla.redhat.com/show_bug.cgi?id=1720114 • CWE-284: Improper Access Control •