72 matches found
Ubuntu: Security Advisory (USN-3953-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-3953-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3953-1 advisory. It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could use this issue to cause PHP to crash...
CVE-2015-3953
creationtimestamp| type| source ---|---|--- 2019-03-25 19:27:41+00:00| seen| https://t.me/cibsecurity/3330...
CVE-2015-3953
CVE-2015-3953 affects Hospira Plum A+ Infusion System (versions prior to 13.4), Plum A+3 Infusion System (prior to 13.6), and Symbiq Infusion System (prior to 3.13). Root cause: hard-coded credentials allowing access via affected devices; additional risk factors include services listening on Port...
Linksys ESeries OS Command Injection (CVE-2018-3953; CVE-2018-3954; CVE-2018-3955)
A command injection vulnerability exists in the Linksys E Series line of routers. An attacker can exploit these bugs by sending an authenticated HTTP request to the network configuration service. An attacker could then gain the ability to arbitrarily execute code on the machine...
CVE-2018-3953
Devices in the Linksys ESeries line of routers Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04 are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input...
CVE-2018-3953
CVE-2018-3953/3954/3955 affects Linksys E-Series (E1200 v2.0.09; E2500 v3.0.04). Root cause: OS command injection via nvram_get/nvram_set path triggered after data from the web portal’s Router Name, written to NVRAM and then executed in preinit/start_lltd, affecting hostname and related domain na...
Vulnerability Spotlight: Linksys ESeries Multiple OS Command Injection Vulnerabilities
These vulnerabilities were discovered by Jared Rittle of Cisco Talos. Cisco Talos is disclosing several vulnerabilities in the operating system on the Linksys E Series of routers. Multiple exploitable OS command injection vulnerabilities exist in the Linksys E Series line of routers. An attacker...
CVE-2018-3953
creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/linksyse1500e2500exec.rb 2018-05-29 15:50:33+00:00| seen|...
CVE-2016-3953
The CVE-2016-3953 issue affects web2py before 2.14.2, where the hardcoded encryption key used in session.connect can enable remote code execution. The vulnerability is documented with a high/severe impact (CVSS v3.0: 9.8 CRITICAL; CVSS v2.0: 7.5 HIGH). Affected component: the session handling in ...
UBUNTU-CVE-2016-3953
The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function...
Debian DSA-3953-1 : aodh - security update
Zane Bitter from Red Hat discovered a vulnerability in Aodh, the alarm engine for OpenStack. Aodh does not verify that the user creating the alarm is the trustor or has the same rights as the trustor, nor that the trust is for the same project as the alarm. The bug allows that an authenticated us...
CVE-2010-3953
CVE-2010-3953 is rejected/not used and does not represent an active vulnerability entry.
FreeBSD : FreeBSD -- Kernel memory disclosure in control messages and SCTP (7240de58-6007-11e6-a6c3-14dae9d210b8)
Buffer between control message header and data may not be completely initialized before being copied to userland. CVE-2014-3952 Three SCTP cmsgs, SCTPSNDRCV, SCTPEXTRCV and SCTPRCVINFO, have implicit padding that may not be completely initialized before being copied to userland. In addition, thre...
Fedora Update for nx-libs FEDORA-2015-3953
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Adobe Reader U3D array boundary code execution (APSB10-02: CVE-2009-3953)
A memory corruption vulnerability has been reported in Adobe Reader and Acrobat. The vulnerability is due to incorrect memory buffer allocation while parsing a corrupted PDF file. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file...
Debian DSA-3070-1 : kfreebsd-9 - security update
Several vulnerabilities have been discovered in the FreeBSD kernel that may lead to a denial of service or information disclosure. - CVE-2014-3711 Denial of service through memory leak in sandboxed namei lookups. - CVE-2014-3952 Kernel memory disclosure in sockbuf control messages. - CVE-2014-395...
CVE-2014-3953
CVE-2014-3953 affects FreeBSD kernels where SCTP-related control messages (SCTP_SNDRCV, SCTP_EXTRCV, SCTP_RCVINFO) and a set of notifications (SCTP_PEER_ADDR_CHANGE, SCTP_REMOTE_ERROR, SCTP_AUTHENTICATION_EVENT) may leak kernel memory due to improper initialization of data structures. Exploitatio...
CVE-2014-3953
FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a 1 SCTPSNDRCV, 2 SCTPEXTRCV, or 3 SCTPRCVINFO SCTP cmsg or a 4 SCTPPEERADDRCHANGE, 5...