Cisco NX-OS Software Command Injection Vulnerabilities (CVE-2019-1774, CVE-2019-1775)

Multiple vulnerabilities in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of arguments passed to certain CLI commands. An...

Improper Input Validation

The sudo superuser do utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain...

Security Bulletin: A vulnerability affects the IBM FlashSystem V840

Summary There is a vulnerability to which the FlashSystem™ V840 is susceptible. An exploit of this vulnerability could make the system subject to an attack where an unauthenticated user could download arbitrary files form the operating system. Vulnerability Details CVEID: CVE-2018-1775 DESCRIPTIO...

CVE-2018-1775

CVE-2018-1775 affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products. The vulnerability allows an authenticated user to download arbitrary files from the operating system via the Service Assistant GUI. Affected software includes versions 7.5 through ...

CVE-2018-18755

K-iwi Framework 1775 has SQL Injection via the admin/user/group/update usergroupid parameter or the admin/user/user/update userid parameter...

CVE-2018-18755

K-iwi Framework 1775 has SQL Injection via the admin/user/group/update usergroupid parameter or the admin/user/user/update userid parameter...

OracleVM 3.2 : sudo (OVMSA-2016-0079)

The remote OracleVM system is missing necessary patches to address critical security updates : - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210 - backported fixes for CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-277...

CVE-2016-1775

TrueTypeScaler in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted font file...

CVE-2016-1775

CVE-2016-1775 corresponds to a TrueTypeScaler memory corruption issue in Apple’s font processing stack. In affected products (iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, watchOS before 2.2), a crafted font file could lead to arbitrary code execution or memory corruption, i.e., a remote ...

CVE-2015-1775

Apache Ambari (1.5.0–2.0.2) is vulnerable to SSRF via the proxy endpoint api/v1/proxy. The issue allows remote authenticated users to perform port scans and access unsecured services through a crafted REST call, due to improper validation in the proxy handling. Impact details in multiple sources ...

CVE-2015-1775

Server-side request forgery SSRF vulnerability in the proxy endpoint api/v1/proxy in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call...

Oracle: Security Advisory (ELSA-2011-0871)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2013-259)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple OS X present in the system can enhance the root access API Backdoor-vulnerability warning-the black bar safety net

0x00 summary Apple OS X system Admin framework presence can elevate the root permissions of the API to the back door, and has been in existence for many years, at least from the 2 0 1 1 years. I was in 2 0 1 4 years 1 0 months to discover he can be used to have any user permissions elevated to ro...

CentOS 6 : sudo (CESA-2013:1701)

An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CentOS 5 : sudo (CESA-2013:1353)

An updated sudo package that fixes multiple security issues and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Microsoft Internet Explorer Memory Corruption (MS14-035; CVE-2014-1775)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...

Mac OS X Sudo Password Bypass

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'shellwords' class Metasploit3...

openSUSE Security Update : sudo (openSUSE-SU-2013:0495-1)

sudo was updated to fix two security issues, where adjusting the time of the syste could be used to regain access to sudo sessions if they onc were granted. CVE-2013-1775,CVE-2013-1776 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Memory corruption

Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1775, CVE-2014-1779, CVE-2014-1799,...