Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2020-5512)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5512 advisory. 2.6.39-400.318.1 - x86/speculation: Determine swapgs before alternative instructions are set Patrick Colp Orabug: 30379640 - scsi: libsas: delete sas port i...

RHEL 6 : kernel-rt (RHSA-2020:0100)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0100 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

CentOS 6 : firefox (RHSA-2020:0086)

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0086 advisory. - When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injecti...

RHEL 6 : chromium-browser (RHSA-2020:0084)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0084 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 79.0.3945.117. Security Fixes:...

RHEL 6 : firefox (RHSA-2020:0086)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0086 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

CVE-2011-2715

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names...

Sql injection

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names...

CVE-2011-2715

Drupal 6.20 with Data 6.x-1.0-alpha14 is affected by an SQL Injection vulnerability caused by insufficient sanitization of table names or column names. The flaw can compromise data confidentiality and integrity (per CVE description). The connected records corroborate this issue across multiple so...

CVE-2011-2715

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names...

CVE-2011-2714

A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by IBM Security Guardium. These issues were disclosed as part of the IBM Java SDK updates in July 2019. Vulnerability Details CVEID: CVE-2019-2766 DESCRIPTION: An unspecified vulnerability in Oracle Ja...

Security Bulletin: OpenSSL as used in IBM QRadar SIEM is vulnerable to a timing side channel attack (CVE-2018-0734)

Summary OpenSSL as used in IBM QRadar SIEM is vulnerable to a timing side channel attack Vulnerability Details CVEID: CVE-2018-0734 DESCRIPTION: The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing...

CVE-2014-5209

An Information Disclosure vulnerability exists in NTP 4.2.7p25 private mode 6/7 messages via a GETRESTRICT control message, which could let a malicious user obtain sensitive information...

CVE-2014-5209

An Information Disclosure vulnerability exists in NTP 4.2.7p25 private mode 6/7 messages via a GETRESTRICT control message, which could let a malicious user obtain sensitive information...

JVN#97325754: F-RevoCRM vulnerable to cross-site scripting

F-RevoCRM provided by ThinkingReed inc. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Apply the Patch Apply the patch according to the information provided by the developer. Apply Workaround Applying the...

gksu-polkit privilege exploit

gksu-polkit is a package for authenticating users to enter commands. A privilege-lifting vulnerability in gksu-polkit version 0.0.3-6.fc18 can be exploited by an attacker to execute arbitrary code with administrative privileges and take control of a vulnerable computer...

RHEL 6 : chromium-browser (RHSA-2020:0005)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0005 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 79.0.3945.88. Security Fixes:...

CVE-2014-3590

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

CVE-2014-0169

In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an authenticated user in one application to access protected resources in another application without proper authorization. Although this is an...

Cross site request forgery (csrf)

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...