Weekly Update: a new vulnerability is published on the National Vulnerability Database (5 items)

New vulnerabilities from the NVD: CVE-2013-2095 rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection Published at: December 10, 2019 at 04:15PM View on website December 10, 2019 at 05:50PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-1793 openstack-utils openstack-db has insecure password creation Published at: December 10, 2019 at 04:15PM View on website December 10, 2019 at 05:50PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-0293 oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation Published at: December 10, 2019 at 04:15PM View on website December 10, 2019 at 05:50PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-5620 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Published at: December 10, 2019 at 09:15PM View on website December 11, 2019 at 12:07AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1577 lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. Published at: December 10, 2019 at 09:15PM View on website December 11, 2019 at 12:07AM via National Vulnerability Database

Weekly Update: a new vulnerability is published on the National Vulnerability Database (40 items)

New vulnerabilities from the NVD: CVE-2019-12503 Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device. Published at: December 02, 2019 at 07:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-12394 Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication. Published at: December 02, 2019 at 07:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-12393 Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests. Published at: December 02, 2019 at 07:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-12392 Anviz access control devices allow remote attackers to issue commands without a password. Published at: December 02, 2019 at 07:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-12391 The Anviz Management System for access control has insufficient logging for device events such as door open requests. Published at: December 02, 2019 at 07:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-12390 Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without credentials via port tcp/5010. Published at: December 02, 2019 at 07:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-12389 Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credentials via port tcp/5010. Published at: December 02, 2019 at 07:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-12388 Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010. Published at: December 02, 2019 at 07:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2015-4457 (cloudera_manager) Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors. Published at: November 26, 2019 at 05:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2015-3406 The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors. Published at: November 29, 2019 at 11:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2015-2060 cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash. Published at: November 29, 2019 at 11:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2015-1855 verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters. Published at: November 29, 2019 at 11:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2015-0837 The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack." Published at: November 30, 2019 at 12:15AM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-9356 Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile. Published at: December 02, 2019 at 08:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-3591 Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication. Published at: November 30, 2019 at 12:15AM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-7484 Zabbix before 5.0 represents passwords in the users table with unsalted MD5. Published at: November 30, 2019 at 04:15AM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-4410 ReviewBoard: has an access-control problem in REST API Published at: December 02, 2019 at 08:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-5562 rhn-proxy: may transmit credentials over clear-text when accessing RHN Satellite Published at: December 02, 2019 at 09:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-4576 FreeBSD: Input Validation Flaw allows local users to gain elevated privileges Published at: December 02, 2019 at 08:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-4526 piwigo has XSS in password.php (incomplete fix for CVE-2012-4525) Published at: December 02, 2019 at 08:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-4525 piwigo has XSS in password.php Published at: December 02, 2019 at 08:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-4480 mom creates world-writable pid files in /var/run Published at: December 02, 2019 at 08:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-4428 openslp: SLPIntersectStringList()' Function has a DoS vulnerability Published at: December 02, 2019 at 08:15PM View on website December 03, 2019 at 04:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-2228 SaltStack RSA Key Generation allows remote users to decrypt communications Published at: December 03, 2019 at 04:15PM View on website December 03, 2019 at 06:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-2106 webauth before 4.6.1 has authentication credential disclosure Published at: December 03, 2019 at 04:15PM View on website December 03, 2019 at 06:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-2103 OpenShift cartridge allows remote URL retrieval Published at: December 03, 2019 at 04:15PM View on website December 03, 2019 at 06:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-2101 Katello has multiple XSS issues in various entities Published at: December 03, 2019 at 04:15PM View on website December 03, 2019 at 06:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-4486 Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging Published at: December 03, 2019 at 05:15PM View on website December 03, 2019 at 08:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-4411 Review Board: URL processing gives unauthorized users access to review lists Published at: December 03, 2019 at 05:15PM View on website December 03, 2019 at 08:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-4235 shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees Published at: December 03, 2019 at 05:15PM View on website December 03, 2019 at 08:49PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-7325 An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball. Published at: December 04, 2019 at 01:15AM View on website December 04, 2019 at 04:49AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1104 A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed. Published at: December 05, 2019 at 08:15PM View on website December 05, 2019 at 11:05PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1105 An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner. Published at: December 05, 2019 at 09:15PM View on website December 06, 2019 at 01:05AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1592 A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. Published at: December 05, 2019 at 11:15PM View on website December 06, 2019 at 03:05AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1115 A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php. Published at: December 05, 2019 at 11:15PM View on website December 06, 2019 at 03:05AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1114 A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php. Published at: December 05, 2019 at 11:15PM View on website December 06, 2019 at 03:05AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1615 A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file. Published at: December 06, 2019 at 06:15PM View on website December 06, 2019 at 09:05PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-2148 An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies Published at: December 06, 2019 at 08:15PM View on website December 06, 2019 at 11:05PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-2130 A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys. Published at: December 06, 2019 at 08:15PM View on website December 06, 2019 at 11:05PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-2092 A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature. Published at: December 06, 2019 at 07:15PM View on website December 06, 2019 at 11:05PM via National Vulnerability Database

Weekly Update: New diabetes clinical trial (11 items)

New diabetes clinical trial: Prepivotal Omnipod Horizon™ Automated Glucose Control System Published on: November 25, 2019 at 07:00PM Condition:   Type 1 Diabetes Mellitus Intervention:   Device: Omnipod Horizon™ Automated Glucose Control System Sponsor:   Insulet Corporation Not yet recruiting https://clinicaltrials.gov/ct2/show/NCT04176731?term=diabetes&sfpd_d=14 November 25, 2019 at 02:58PM via ClinicalTrials.gov New diabetes clinical trial: Real-world Health Outcomes in Canadian Patients Using Semaglutide Published on: November 25, 2019 at 07:00PM Condition:   Type 2 Diabetes Intervention:   Drug: Semaglutide Sponsor:   LMC Diabetes & Endocrinology Ltd. Not yet recruiting https://clinicaltrials.gov/ct2/show/NCT04175665?term=diabetes&sfpd_d=14 November 25, 2019 at 02:58PM via ClinicalTrials.gov New diabetes clinical trial: Determining Serum and Urinary Levels of miRNA 192 and miRNA 25 in Patients With and Without Type 2 Diabetes. Published on: November 25, 2019 at 07:00PM Conditions:   Diabetic Kidney Disease;   Type2 Diabetes Intervention:   Other: no interventions required. Sponsor:   University of Pisa Recruiting https://clinicaltrials.gov/ct2/show/NCT04176276?term=diabetes&sfpd_d=14 November 25, 2019 at 02:58PM via ClinicalTrials.gov New diabetes clinical trial: Investigation for Health Efficacy of Infrared-C Radiation on Diabetes Patients in Senior's Activity Center Published on: November 26, 2019 at 07:00PM Condition:   Diabetes Mellitus, Type 2 Interventions:   Device: FIR-C mattress;   Device: FIR-C abdominal pad;   Device: fake FIR-C mattress;   Device: fake FIR-C abdominal pad Sponsors:   Nanhua University;   Buddhist Dalin Tzu Chi General Hospital;   Solano Semiconductor Technology., LTD. Recruiting https://clinicaltrials.gov/ct2/show/NCT04177420?term=diabetes&sfpd_d=14 November 26, 2019 at 03:43PM via ClinicalTrials.gov New diabetes clinical trial: Incretin Hormones in Type 1 Diabetes Mellitus;Effect of Metformin Treatment Published on: November 26, 2019 at 07:00PM Condition:   Type 1 Diabetes Mellitus Interventions:   Drug: Metformin;   Drug: Placebo Sponsor:   Hellenic Institute for the Study of Sepsis Not yet recruiting https://clinicaltrials.gov/ct2/show/NCT04177303?term=diabetes&sfpd_d=14 November 26, 2019 at 03:43PM via ClinicalTrials.gov New diabetes clinical trial: Primary Care Clinicians' Responses to a Hypoglycemia Risk Calculator for Diabetes Mellitus in Ambulatory Care Published on: November 26, 2019 at 07:00PM Conditions:   Hypoglycemia;   Diabetes Mellitus Intervention:   Other: Clinical decision support via alert tool Sponsor:   Indiana University Completed https://clinicaltrials.gov/ct2/show/NCT04177147?term=diabetes&sfpd_d=14 November 26, 2019 at 03:43PM via ClinicalTrials.gov New diabetes clinical trial: Anti Oxidant Enzymes and Total Antioxidant Levels in Diabetes Mellitus Type II Patients and Healthy Individuals With Periodontitis Published on: November 27, 2019 at 07:00PM Conditions:   Periodontal Diseases;   Diabetes Mellitus;   Enzyme Disorder Intervention:   Diagnostic Test: Blood sample Sponsor:   Ajman University Completed https://clinicaltrials.gov/ct2/show/NCT04180332?term=diabetes&sfpd_d=14 November 27, 2019 at 11:43PM via ClinicalTrials.gov New diabetes clinical trial: Gastric Ultrasound for Preoperative Assessment of Gastric Content in Diabetic Patients Published on: November 29, 2019 at 07:00PM Conditions:   Aspiration Pneumonia;   Gastric Volume Intervention:   Device: Ultrasound Sponsor:   Second Affiliated Hospital, School of Medicine, Zhejiang University Recruiting https://clinicaltrials.gov/ct2/show/NCT04181814?term=diabetes&sfpd_d=14 November 29, 2019 at 03:24PM via ClinicalTrials.gov New diabetes clinical trial: Real-world Study Comparing the Adherence and Effectiveness of Linagliptin vs. Acarbose Published on: November 28, 2019 at 07:00PM Condition:   Diabetes Mellitus, Type 2 Interventions:   Drug: Linagliptin;   Drug: Acarbose Sponsor:   Boehringer Ingelheim Not yet recruiting https://clinicaltrials.gov/ct2/show/NCT04180813?term=diabetes&sfpd_d=14 November 29, 2019 at 03:24PM via ClinicalTrials.gov New diabetes clinical trial: A Randomized Trial of a BE-EHR Module to Guide the Care of Older Adults With Diabetes Published on: November 28, 2019 at 07:00PM Condition:   Diabetes Intervention:   Behavioral: BE-EHR module Sponsor:   NYU Langone Health Not yet recruiting https://clinicaltrials.gov/ct2/show/NCT04181307?term=diabetes&sfpd_d=14 November 29, 2019 at 03:24PM via ClinicalTrials.gov New diabetes clinical trial: Lowering the Impact of Food Insecurity in African American Adults With Type 2 Diabetes Mellitus (LIFT-DM) Published on: November 28, 2019 at 07:00PM Condition:   Type 2 Diabetes Interventions:   Behavioral: Diabetes Education Plus Monthly Food Vouchers;   Behavioral: Diabetes Education Plus Combination of Monthly Food Vouchers and Stock Boxes;   Behavioral: Diabetes Education Only;   Behavioral: Diabetes Education Plus Monthly Stock Boxes Sponsor:   Medical College of Wisconsin Recruiting https://clinicaltrials.gov/ct2/show/NCT04181424?term=diabetes&sfpd_d=14 November 29, 2019 at 03:24PM via ClinicalTrials.gov