Red Hat glusterfs server remote code execution vulnerability

Red Hat glusterfs server is an open source distributed file system from Red Hat Red Hat. The system is mainly for media streaming , data analysis and other data and bandwidth intensive tasks to create large-scale distributed storage solutions. A security vulnerability exists in the Red Hat...

CVE-2018-10904: Untrusted Search Path

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient...

ASP.NET DEBUG Method Enabled

It is possible to send debug statements to the remote ASP scripts via the http DEBUG method. A remote, unauthenticated attacker may leverage this to alter the runtime of the remote scripts. No source data...

New Android Malware Framework Turns Apps Into Powerful Spyware

Security researchers have uncovered a new, powerful Android malware framework that is being used by cybercriminals to turn legitimate apps into spyware with extensive surveillance capabilities—as part of what seems to be a targeted espionage campaign. Legitimate Android applications when bundled...

ALPINE-CVE-2018-15468

An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the...

UBUNTU-CVE-2018-15468

An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the...

DEBIAN-CVE-2018-15468

An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the...

RHEL 7 : kernel (RHSA-2018:2389)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2389 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Modern operating systems implement...

0.8.18-p11 (0.8.18-p12), 04_nodeblog (1.0.0) +25792 more potentially affected by CVE-2017-16137 via debug (>=2.0.0, <=2.6.8)

debug NPM version =2.0.0, =1.0.0, =0.0.15, =1.0.4, =0.0.1, =1.0.3, =0.0.1, =0.1.0, =1.0.2, =1.0.1, =1.0.2 and more Source cves: CVE-2017-16137 Source advisory: OSV:GHSA-GXPJ-CX7G-858C...

@bahmutov/add-typescript-to-cypress (>=1.0.2, <=1.1.1), @betit/orion (>=1.0.0-beta.1, <=1.0.0-beta.6) +176 more potentially affected by CVE-2017-16137 via debug (>=3.0.0, <=3.0.1)

debug NPM version =3.0.0, =1.0.2, =1.0.0-beta.1, =1.0.0-beta.6, =2.0.1-SNAPSHOT.88, =0.0.4, =0.0.12, =1.0.1, =1.0.0, =1.0.0, =0.1.5, =2.8.0, =1.0.71, =1.0.10-14, =1.1.16 and more Source cves: CVE-2017-16137 Source advisory: OSV:GHSA-GXPJ-CX7G-858C...

1ib (>=1.0.9, <=1.0.11), 20190403-utils (1.0.0) +10604 more potentially affected by CVE-2017-16137 via debug (>=4.0.0, <=4.3.0)

debug NPM version =4.0.0, =1.0.9, =1.0.1, =1.1.2, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0-alpha.19, =1.2.3 and more Source cves: CVE-2017-16137 Source advisory: OSV:GHSA-GXPJ-CX7G-858C...

GHSA-GXPJ-CX7G-858C Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue. This was later re-introduced in version v3.2.0, and...

Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue. This was later re-introduced in version v3.2.0, and...

@0ti.me/test-deps (>=0.1.1, <=0.1.22), @0ti.me/ts-test-deps (>=0.1.0, <=0.1.3) +2446 more potentially affected by CVE-2017-16137 via debug (>=3.2.0, <=3.2.6)

debug NPM version =3.2.0, =0.1.1, =0.1.0, =1.0.0, =0.2.39, =1.0.2, =2.0.3, =1.1.1, =0.0.34, =1.0.1, =1.0.2, =1.0.2, =0.0.2, =0.0.2, =0.1.0, =0.3.0 and more Source cves: CVE-2017-16137 Source advisory: OSV:GHSA-GXPJ-CX7G-858C...

Tamper proofing review: the iZettle card payment terminal

Tamper resistance is an increasingly important factor in smart devices. Together with secure hardware design and defensive coding, it can deliver a very secure device. One of the most common areas the average consumer will encounter tamper resistant devices is in payment terminals, or Pin Entry...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2018-4189)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-4189 advisory. - tcp: add tcpoootrycoalesce helper Eric Dumazet Orabug: 28453849 CVE-2018-5390 - tcp: call tcpdrop from tcpdataqueueofo Eric Dumazet Orabug: 28453849...

katello-debug Arbitrary File Overwrite Vulnerability

Katello is a system management engine that provides workflows for configuration management, subscription management and content management. katello-debug is one of the debuggers. An arbitrary file overwrite vulnerability exists in versions prior to katello-debug 3.4.0, which stems from the use of...

CVE-2018-7947

Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153C00 have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific...

CVE-2018-7947

Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153C00 have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific...

CVE-2018-7947

Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153C00 have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific...