VMware vCenter Server vmdir Authentication Bypass

This module bypasses LDAP authentication in VMware vCenter Server's vmdir service to add an arbitrary administrator user. Version 6.7 prior to the 6.7U3f update is vulnerable, only if upgraded from a previous release line, such as 6.0 or 6.5. Note that it is also possible to provide a bind userna...

VMSA-2020-0006:VMware vCenter Server updates address sensitive information disclosure vulnerability in the VMware Directory Service (vmdir)

Advisory ID: VMSA-2020-0006.1 CVSSv3 Range: 10.0 Issue Date:2020-04-09 Updated On: 2020-04-16 Initial Advisory CVEs: CVE-2020-3952 Synopsis: VMware vCenter Server updates address sensitive information disclosure vulnerability in the VMware Directory Service vmdir CVE-2020-3952 RSS Feed Download P...

Ubuntu: Security Advisory (USN-4030-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS / 18.04 LTS : Pacemaker vulnerabilities (USN-3952-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3952-1 advisory. Jan Pokorn discovered that Pacemaker incorrectly handled client-server authentication. A local attacker could possibly use this issue to...

CVE-2015-3952

creationtimestamp| type| source ---|---|--- 2019-03-25 19:27:42+00:00| seen| https://t.me/cibsecurity/3331...

CVE-2015-3952

Summary: CVE-2015-3952 concerns information disclosure from Hospira infusion systems where wireless keys are stored in plain text. Affected products: Plum A+ Infusion System v13.4 and earlier, Plum A+3 Infusion System v13.6 and earlier, and Symbiq Infusion System v3.13 and earlier. Root cause: cl...

ProtonVPN, NordVPN Flaws Open Door to Privilege Escalation

UPDATE A pair of vulnerabilities in the ProtonVPN and NordVPN VPN clients have been uncovered, which allow attackers to execute code as an administrator on targeted Microsoft Windows machines. In both cases CVE-2018-3952 NordVPN and CVE-2018-4010 ProntonVPN, the clients have the same design,...

CVE-2018-3952

An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially crafted configuration file can cause a privilege escalation, resulting in the execution of arbitrary commands with system privileges...

CVE-2018-3952

CVE-2018-3952 affects NordVPN 6.14.28.0. Two-part design: a GUI (standard user) communicates with a service (system privileges) that executes OpenVPN with the user configuration. Root cause: insufficient validation of OpenVPN config lines allows injection via quoted options (e.g., "script-securit...

CVE-2018-3952

creationtimestamp| type| source ---|---|--- 2018-09-07 14:47:41+00:00| seen| https://t.me/ctinow/2186...

Vulnerability Spotlight: CVE-2018-3952 / CVE-2018-4010 - Multi-provider VPN Client Privilege Escalation Vulnerabilities

Discovered by Paul Rascagneres. Overview Cisco Talos has discovered two similar vulnerabilities in the ProtonVPN and NordVPN VPN clients. The vulnerabilities allow attackers to execute code as an administrator on Microsoft Windows operating systems from a standard user. The vulnerabilities were...

Adobe Illustrator Multiple Buffer Overflow Vulnerabilities (APSB10-01) - Windows

Adobe Illustrator is prone to multiple buffer overflow vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-3952

...

CVE-2017-3952

CVE-2017-3952 is rejected/not used and does not represent an active vulnerability entry.

CVE-2016-3952

web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/templateexamples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access...

CVE-2016-3952

web2py (standalone) before 2.14.1 is affected by CVE-2016-3952: an attacker can request examples/template_examples/beautify to obtain environment variable values, which can be leveraged to gain administrative access. The issue aligns with documented exposure of sensitive information in web2py-rel...

Debian DSA-3952-1 : libxml2 - security update

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the...

Debian: Security Advisory (DSA-3952-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : FreeBSD -- Kernel memory disclosure in control messages and SCTP (7240de58-6007-11e6-a6c3-14dae9d210b8)

Buffer between control message header and data may not be completely initialized before being copied to userland. CVE-2014-3952 Three SCTP cmsgs, SCTPSNDRCV, SCTPEXTRCV and SCTPRCVINFO, have implicit padding that may not be completely initialized before being copied to userland. In addition, thre...

Debian DSA-3070-1 : kfreebsd-9 - security update

Several vulnerabilities have been discovered in the FreeBSD kernel that may lead to a denial of service or information disclosure. - CVE-2014-3711 Denial of service through memory leak in sandboxed namei lookups. - CVE-2014-3952 Kernel memory disclosure in sockbuf control messages. - CVE-2014-395...