VulnCheck KEV: CVE-2017-6740

The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload...

VulnCheck KEV: CVE-2017-6739

The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload...

SUSE: Security Advisory (SUSE-SU-2022:0679-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for php7 (openSUSE-SU-2022:0679-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:0679-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0679-1 advisory. - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM bsc1192050. - CVE-2021-21707: Fixed special character breaks path in...

SUSE-SU-2022:0679-1 Security update for php7

This update for php7 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM bsc1192050. - CVE-2021-21707: Fixed special character breaks path in xml parsing bsc1193041. - CVE-2017-8923: Fixed denial of service application crash when using .= with a long string...

Security update for php7 (moderate)

openSUSE Security Update: Security update for php7 Announcement ID: openSUSE-SU-2022:0679-1 Rating: moderate References: 1038980 1081790 1192050 1193041 Cross-References: CVE-2015-9253 CVE-2017-8923 CVE-2021-21703 CVE-2021-21707 CVSS scores: CVE-2015-9253 NVD : 6.5...

CLSA-2022-1646085834 Fix CVE(s): CVE-2017-9118, CVE-2017-9119, CVE-2017-9120, CVE-2021-21707, CVE-2017-8923, CVE-2015-9253

SECURITY UPDATE: Denial of service - debian/patches/CVE-2015-9253-pre1.patch: include .inc files used in fpm tests in sapi/fpm/tests/ alogin with other .phpt test scripts. - debian/patches/CVE-2015-9253-pre2.patch: close the listening socket on sapi/fpm/fpm/fpmsignals.c and added tests in...

Analysis and Protections for RagnarLocker Ransomware

Trellix Global Defenders: Analysis and Protections for RagnarLocker Ransomware By Taylor Mullins · February 28, 2022 The United States Federal Bureau of Investigation FBI has released a Flash Alert warning that the RagnarLocker ransomware gang has breached the networks of at least fifty-two...

Analysis and Protections for RagnarLocker Ransomware

Trellix Global Defenders: Analysis and Protections for RagnarLocker Ransomware By Taylor Mullins · February 28, 2022 The United States Federal Bureau of Investigation FBI has released a Flash Alert warning that the RagnarLocker ransomware gang has breached the networks of at least fifty-two...

CVE-2017-11443

CVE-2017-11443 is a Debian-listed vulnerability in qemu, specifically an out-of-bounds/out-of-band memory access issue in SLIRP/DHCP. Debian’s advisory DSA-3925-1 confirms multiple qemu CVEs and notes this CVE affected qemu’s SLIRP/DHCP path. The fix shipped in the Stretch package update: upgrade...

SUSE: Security Advisory (SUSE-SU-2022:0577-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-1213

CVE-2017-1213 is cited in IBM BigInsights security bulletin as a Denial-of-Service flaw in Open Source Zookeeper affecting IBM BigInsights (IBM Open Platform with Apache Hadoop). The vulnerability could be exploited by an authenticated user when Jetty AdminServer is not available, and access is b...

CVE-2017-1399

CVE-2017-1399 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance. The vulnerability stems from weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Affected IGI releases include 5.2, 5.2.1, 5.2.2, 5.2.2....

CVE-2017-1464

IBM TRIRIGA is affected by CVE-2017-1464 due to the failure to enable HTTP Strict Transport Security (HSTS), enabling a remote attacker to obtain sensitive information via man-in-the-middle techniques. Affected IBM TRIRIGA Platform versions include 3.5.0–3.5.3.0, 3.4.0–3.4.2.5, and 3.3.0–3.3.2.5....

CVE-2017-1547

CVE-2017-1547 affects IBM Emptoris Services Procurement. The vulnerability enables username enumeration through the forgot-password flow, allowing an attacker to determine valid usernames and potentially brute-force credentials. This concerns IBM Emptoris Services Procurement 10.0.0.x. Root cause...

CVE-2017-17768

CVE-2017-17768 is listed in the Qualcomm section as affecting the LK bootloader with a High severity (QC-CR#2127172). The connected Android security bulletin entry confirms this CVE without providing explicit root-cause or mitigation details within the document. No additional exploit specifics or...

CVE-2017-16087

The connected advisories describe a vulnerability in the npm package fs-git where strings passed to the buildCommand method are not sanitized, allowing arbitrary code execution. Affected versions of fs-git do not sanitize inputs, enabling code execution via crafted input in buildCommand. The issu...

CVE-2017-16034

The CVE-2017-16034 entry maps to a real vulnerability in the Node.js pidusage package: affected versions pass unsanitized input to child_process.exec(), allowing arbitrary code execution in the ps method. The PoC is viable on Darwin, SunOS, FreeBSD, and AIX; Windows and Linux are not affected. Re...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types a...