Oracle Linux 7 : qemu-kvm (ELSA-2017-3368)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3368 advisory. - Resolves: bz1501120 CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image rhel-7.4.z Tenable has extracted the precedi...

CVE-2017-3368

CVE-2017-3368 affects Oracle E-Business Suite’s Oracle iStore (Address Book) across 12.1.1–12.2.6. An unauthenticated attacker with network access via HTTP can compromise iStore; successful exploits require user interaction. The vulnerability grants access to critical Oracle iStore data and may a...

U.S. Dept Of Defense: Out-of-date Version (Apache)

URL https://████████/ Identified Version 2.2.15 contains 4 important and 10 other vulnerabilities Latest Version 2.2.31 Vulnerability Database Result is based on 27.10.2016 vulnerability database content. Vulnerability Details Link identified you are using an out-of-date version of Apache. Impact...

Microsoft Windows Domain User Code Execution (MS16-110; CVE-2016-3368)

A code execution vulnerability exists in Microsoft Windows. The vulnerability is due to the way objects are handled in memory. A remote attacker with domain credentials can exploit this vulnerability by sending specially crafted requests to the target server...

CVE-2016-3368

CVE-2016-3368 affects multiple Windows editions (Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, 8.1, Server 2012 Gold/R2, Windows RT 8.1, and Windows 10 (initial 1511/1607)). It is a remote code execution vulnerability caused by how Windows handles objects in memory. An attacker with domain cr...

MS16-110: Security Update for Microsoft Windows (3178467)

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists due to a failure to properly enforce permissions when loading specially crafted DLLs. A local attacker can exploit this vulnerability to...

KLA11907 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service, obtain sensitive information, bypass security restrictions. Below is a complete list of...

Oracle: Security Advisory (ELSA-2011-1391)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2011-1392)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3368-1 : cyrus-sasl2 - security update

It was discovered that cyrus-sasl2, a library implementing the Simple Authentication and Security Layer, does not properly handle certain invalid password salts. A remote attacker can take advantage of this flaw to cause a denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

Amazon Linux: Security Advisory (ALAS-2011-9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-3368

Cross-site scripting XSS vulnerability in the administration user interface in the Classified Ads module before 6.x-3.1 and 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a category name...

CVE-2015-3368

CVE-2015-3368 affects Drupal Classified Ads module (versions prior to 6.x-3.1 and 7.x-3.x prior to 7.x-3.1). The vulnerability is a cross-site scripting (XSS) in the administration UI where remote authenticated users with the administer taxonomy permission can inject arbitrary script/HTML via the...

SA-CONTRIB-2015-023 - Classified Ads - Cross Site Scripting (XSS)

Classified Ads module enables administrators to create classified ads in various categories. The module doesn't correctly escape the category names in its administration user interface. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer...

openSUSE Security Update : apache2 (openSUSE-SU-2014:1647-1)

This apache version update fixes various security and non security issues. - Updated to the 2.2.29 - Changes between 2.2.22 and 2.2.29: http://www.apache.org/dist/httpd/CHANGES2.2 - The following patches are no longer needed and were removed : - httpd-2.2.x-bnc798733-SNIignorecase.diff -...

RHEL 5 / 6 : httpd (RHSA-2012:0542)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0542 advisory. The Apache HTTP Server httpd is the namesake project of The Apache Software Foundation. It was discovered that the Apache HTTP Server di...

CVE-2014-3368

Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Software, versions prior to X8.2, are affected by CVE-2014-3368. A flaw in packet processing when handling a high rate of crafted IP packets can remotely cause a denial of service by triggering a device reload. Exploitation ...

Amazon Linux AMI : httpd (ALAS-2011-9)

It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connec...

openSUSE Security Update : apache2 (openSUSE-SU-2013:0243-1)

ignore case when checking against SNI server names. bnc798733 httpd-2.2.x-bnc798733-SNIignorecase.diff - better cleanup of busy count after recovering from failure bnc789828 httpd-2.2.x-bnc789828-modbalancer.diff - httpd-2.2.x-bnc788121-CVE-2012-4557-modproxyajptimeout.diff: backend timeouts...

openSUSE Security Update : apache2 (openSUSE-SU-2011:1217-1)

This update fixes several security issues in the Apache webserver. The patch for the ByteRange remote denial of service attack CVE-2011-3192 was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded,...