Security Bulletin: CVE-2020-4481 HTTP properties vulnerable to an XXE attack

Summary HTTP properties are vulnerable to an XXE attack. This could allow files from the server host to be extracted. Vulnerability Details CVEID: CVE-2020-4481 DESCRIPTION: IBM UrbanCode Deploy UCD is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote...

Debian DSA-4481-1 : ruby-mini-magick - security update

Harsh Jaiswal discovered a remote shell execution vulnerability in ruby-mini-magick, a Ruby library providing a wrapper around ImageMagick or GraphicsMagick, exploitable when using MiniMagick::Image.open with specially crafted URLs coming from unsanitized user input. C Tenable Network Security,...

Elevation Of Privileges By An Untrusted Search Path Vulnerability

Luci is a web-based high availability administration application. A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the...

Arbitrary Code Execution

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. It was found that certain methods did not sanitize file names before passing them to lower layer routines in Ruby. If a Ruby application created files...

CVE-2017-4481

...

CVE-2017-4481

CVE-2017-4481 is rejected/not used; this entry does not represent an active vulnerability.

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2015:1389-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2013-173)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : MozillaThunderbird (openSUSE-2015-559)

This update to Thunderbird 38.2.0 fixes the following issues bnc940806 : - MFSA 2015-79/CVE-2015-4473 Miscellaneous memory safety hazards - MFSA 2015-80/CVE-2015-4475 bmo1175396 Out-of-bounds read with malformed MP3 file - MFSA 2015-82/CVE-2015-4478 bmo1105914 Redefinition of non-configurable...

openSUSE Security Update : MozillaThunderbird (openSUSE-2015-558)

This update to Thunderbird 38.2.0 fixes the following issues bnc940806 : - MFSA 2015-79/CVE-2015-4473 Miscellaneous memory safety hazards - MFSA 2015-80/CVE-2015-4475 bmo1175396 Out-of-bounds read with malformed MP3 file - MFSA 2015-82/CVE-2015-4478 bmo1105914 Redefinition of non-configurable...

CVE-2015-4481

creationtimestamp| type| source ---|---|--- 2015-08-21 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/37925...

Mozilla Firefox ESR Multiple Vulnerabilities (Aug 2015) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

CVE-2015-4481

Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update...

CVE-2015-4481

CVE-2015-4481 is a concrete vulnerability in Mozilla Maintenance Service on Windows where a hard-link race allows arbitrary file overwriting, enabling local privilege escalation. Public documentation across connected sources confirms the issue affects Windows Firefox/maintenance service and was a...

CVE-2014-4481

CVE-2014-4481 affects Apple TV 3rd generation and later prior to 7.0.3. It is an integer overflow in CoreGraphics when processing PDF files, which can lead to an arbitrary code execution or an application crash. Remediation: update Apple TV to 7.0.3 via the usual Software Update mechanism. Public...

Oracle Solaris Third-Party Patch Update : ruby (cve_2013_4073_cryptographic_issues)

The remote Solaris system is missing necessary patches to address security updates : - The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an...

CentOS 6 : luci (CESA-2013:1603)

Updated luci packages that fix two security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which giv...

Scientific Linux Security Update : luci on SL6.x i386/x86_64 (20131121)

A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the root or luci user. CVE-2013-4482 A flaw was found in the way luci...

CVE-2013-4481

CVE-2013-4481 is a race-condition in Luci 0.26.0 where /var/lib/luci/etc/luci.ini is created with world-readable permissions before restricting them, enabling local users to read authentication secrets. The connected advisories/plugins indicate updated luci packages fix this issue (e.g., RHSA-201...

RHEL 6 : luci (RHSA-2013:1603)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2013:1603 advisory. Luci is a web-based high availability administration application. A flaw was found in the way the luci service was initialized. If a system...