101 matches found
CVE-2018-1258
CVE-2018-1258 affects Spring Framework 5.0.5 when used with any Spring Security version, enabling an authorization bypass for method security. An unauthorized user could access restricted methods. The connected advisory from F5 reiterates the same vulnerability description and lists affected prod...
Spring Security and Spring Framework CVE-2018-1258 Authorization Bypass Vulnerability
...
Debian: Security Advisory (DLA-1258-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DLA-1258-1 : wireshark security update
Kamil Frankowicz and Young found that several parsers of wireshark could be crashed by malformed packets. For Debian 7 'Wheezy', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u6deb7u9. We recommend that you upgrade your wireshark packages. NOTE: Tenable Network Security has...
CVE-2017-1258
IBM Security Guardium has a missing authentication check for a critical resource, allowing anonymous access. Affected versions include Guardium 9.0, 9.1 and 9.5, and 10.0, 10.0.1, 10.1, 10.1.2. CVSSv3 base score 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Remediation/fixes are provided via IBM Fix...
Microsoft MsMpEng - Use-After-Free via Saved Callers
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1259 In JsRuntimeState::setCaller, it saves the current caller in the JsRuntimeState objectrcx+158h in 64-bit. But the garbage collector doesn't mark this saved value. So it results in a UAF. Unlike in our test environmentLinux, it...
Command injection
The Sophos Web Appliance version 4.2.1.3 is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php /controllers/MgrReport.php component responsible for blocking and unblocking IP addresses from...
CVE-2016-9553
CVE-2016-9553 — Sophos Web Appliance 4.2.1.3 is vulnerable to two remote command injection flaws in the web admin interface (MgrReport.php) where user-supplied values for unblockip and blockip are passed to shell_exec without proper escaping. An authenticated, remote attacker could exploit these ...
SUSE: Security Advisory for MozillaFirefox (SUSE-SU-2016:1258-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2016-1258
Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R8, 14.1 before 14.1R6, and 14.2 before 14.2R5, allows remote attackers t...
CVE-2016-1258
The CVE-2016-1258 entry concerns Juniper Junos OS J-Web, which uses Embedthis AppWeb. Affected versions include Junos OS prior to specific builds listed in the description (e.g., before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R10, 12.3X48 before 12.3X4...
Mageia: Security Advisory (MGASA-2015-0249)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Oracle: Security Advisory (ELSA-2012-1258)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MGASA-2015-0249 Updated libvpx package fixes security vulnerability
libvpx before 1.4.0 allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data CVE-2015-1258...
Updated libvpx package fixes security vulnerability
libvpx before 1.4.0 allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data CVE-2015-1258...
openSUSE Security Update : Chromium (openSUSE-2015-390)
Chromium was updated to 43.0.2357.65 to fix security issues and bugs. The following vulnerabilities were fixed : - CVE-2015-1251: Use-after-free in Speech boo931659 - CVE-2015-1252: Sandbox escape in Chrome boo931671 - CVE-2015-1253: Cross-origin bypass in DOM boo931670 - CVE-2015-1254:...
Google Chrome Multiple Vulnerabilities - 02 - (May 2015) - Mac OS X
Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...
[SECURITY] [DSA 3267-1] chromium-browser security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3267-1 [email protected] http://www.debian.org/security/ Michael Gilbert May 22, 2015 http://www.debian.org/security/faq -...
[SECURITY] [DSA 3267-1] chromium-browser security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3267-1 [email protected] http://www.debian.org/security/ Michael Gilbert May 22, 2015 http://www.debian.org/security/faq -...
USN-2610-1: Oxide vulnerabilities
Several security issues were discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to bypass Same Origin Policy restrictions. CVE-2015-1253, CVE-2015-1254 A use-after-free was discovered in the...