CVE-2018-10931

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

Design/Logic Flaw

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

CVE-2018-10931

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

CVE-2018-10931

CVE-2018-10931 affects Cobbler 2.6.x where CobblerXMLRPCInterface private functions were exposed over XMLRPC. This allowed remote, unauthenticated attackers to gain high-privilege access within Cobbler and upload files to arbitrary locations in the daemon context. Related advisories note an authe...

Wireshark 2.6.x < 2.6.2 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 2.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.6.2 advisory. - In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the HTTP2 dissector could crash. This was...

Wireshark Denial of Service Vulnerability (CNVD-2018-13659)

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in the parser used to decompress zlib in Wireshark...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Key Lifecycle Manager (SKLM) (CVE-2012-5783)

Summary IBM WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulleti...

Security Bulletin: IBM Security Key Lifecycle Manager is affected by XML External Entity Injection (XXE) attack (CVE-2017-1666)

Summary IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2017-1666 DESCRIPTION:...

WordPress GD bbPress Attachments plugin <=2.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Luigi Gubello in WordPress GD bbPress Attachments plugin versions =2.5. Solution Update the WordPress GD bbPress Attachments plugin to the latest available version at least 2.6...

EulerOS 2.0 SP2 : kernel (EulerOS-SA-2018-1055)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a...

Design/Logic Flaw

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server...

CVE-2018-1077

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server...

CVE-2018-1077

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server...

LimeSurvey 2.6.x < 2.6.7, 2.7x.x < 2.73.1, 3.x.x < 3.4.2 File Disclosure Vulnerability

LimeSurvey mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

BOCHS 2.6-5 - Local Buffer Overflow

BOCHS 2.6-5 - Local Buffer Overflow Exploit Author: Juan Sacco - http://exploitpack.com Vulnerability found using Exploit Pack v10 - Fuzzer module An attacker could exploit this vulnerability to execute arbitrary code in the context of the application. Failed exploit attempts will result in a...

UBUNTU-CVE-2018-1000004

In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition...

CVE-2017-1000483

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

CVE-2017-1669

IBM Tivoli Key Lifecycle Manager (SKLM) versions 2.5–2.7 store sensitive information in URL parameters, enabling potential information disclosure if URLs are captured in server logs, referer headers, or browser history. Underlying cause is storing sensitive data in URL parameters. Affected versio...

Sandbox Escape

AccessControl is vulnerable to sandbox escapes. Attackers can use the str.format function through web templates to access private content. Note: this is only relevant for projects using Python 2.6 or greater...

CVE-2017-1000483

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...