Shadow Denial of Service Vulnerability

shadow is a suite of tools for maintaining Debian systems. A security vulnerability exists in versions of shadow prior to 4.5. An attacker could exploit this vulnerability with malformed input to cause the suite to crash buffer overflow or memory corruption...

CVE-2017-9461

smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability fdopenatomic infinite loop with high CPU usage and memory consumption due to wrongly handling dangling symlinks...

DEBIAN-CVE-2017-7995

Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the getuser function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL...

Tenable Appliance 4.5 - Root Remote Code Execution

Tenable Appliance 4.5 - Root Remote Code Execution !/bin/bash : ' According to http://static.tenable.com/proddocs/upgradeappliance.html they fixed two security vulnerabilities in the web interface in release 4.5 so I guess previous version are also vulnerable. Exploit Title: Unauthenticated remot...

Jobscript4Web 4.5 SQL Injection

---------------- Title = Jobscript4Web 4.5 - Authentication Bypass Date = 8/4/2017 Soft = http://www.jobscript4web.com/index.html liVE Demo = http://www.simplejobs.co.in/soft4u --------------- AutHor = TurkCyberArmy --------------- Bizler Turk siber ordusu bunyesinde goreve basladik. Dosta guven...

CVE-2017-7228

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...

Input validation

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...

CVE-2016-9378

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service guest crash by leveraging an incorrect choice for software interrupt delivery...

CVE-2016-9378

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service guest crash by leveraging an incorrect choice for software interrupt delivery...

CVE-2016-9873

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information,...

CVE-2016-9872

CVE-2016-9872 affects EMC Documentum D2, specifically versions 4.5 and 4.6, which have reflected Cross-Site Scripting (XSS) vulnerabilities. The issue arises in the handling of user-supplied input, allowing an attacker to potentially compromise the affected system via crafted requests. Public sou...

CVE-2016-9872

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has Reflected Cross-Site Scripting Vulnerabilities that could potentially be exploited by malicious users to compromise the affected system...

EMC Documentum D2 4.5.x and 4.6.x < 4.7 Multiple Vulnerabilities (ESA-2016-167)

The remote host is running a version of EMC Documentum D2 that is 4.5.x or 4.6.x prior to 4.7. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can...

Microsoft Identity Model Extensions Token Signing Verification Privilege Escalation Vulnerability

Description Microsoft Identity Model Extensions is prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft .NET Framework 4.5 Microsoft .NET Framework 4.5.1 Microsoft .NET Framework 4.5.2 Microsoft...

MS15-101: Description of the security update for the .NET Framework 4.5, 4.5.1, and 4.5.2 on Windows 8, Windows RT, and Windows Server 2012: September 8, 2015

MS15-101: Description of the security update for the .NET Framework 4.5, 4.5.1, and 4.5.2 on Windows 8, Windows RT, and Windows Server 2012: September 8, 2015 View products that this article applies to. Summary This update resolves vulnerabilities in the Microsoft .NET Framework that could allow...

CVE-2016-3004

Cross-site request forgery CSRF vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the set of available applications...

CVE-2016-2957

IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading a stack trace in a response...

CVE-2016-2953

CVE-2016-2953 affects IBM Connections 4.0–CR4, 4.5–CR5, and 5.0 before CR4, where SSL is not required, allowing remote attackers to obtain sensitive cleartext information by sniffing the network. The NVD entry documents network-based information disclosure with CVSS v3.0/3.0 metrics (AV:N/AC:H/PR...

DEBIAN-CVE-2016-7917

The nfnetlinkrcvbatch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service infinite loop or out-of-bounds...

Automated Security Response: Falcon Orchestrator

CrowdStrike Falcon Orchestrator is an extendable Windows-based application that provides workflow automation, case management and security response functionality. The tool leverages the highly extensible APIs contained within the CrowdStrike Falcon Connect program. Falcon Orchestrator has only be...