RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 2 (RHSA-2018:0466)

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

kernel security and bug fix update

3.10.0-693.21.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-693.21.1 - x86 platform/uv: Mark tscchecksync as an init function Frank Ramsay...

CVE-2018-7182

The ctlgetitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service out-of-bounds read via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10...

CVE-2018-7182

The CVE-2018-7182 vulnerability affects ntp ntpd versions 4.2.8p6–4.2.8p10, where the ctl_getitem() function can read past the end of its buffer. A remote attacker can send a crafted mode 6 packet to trigger an out-of-bounds read, causing denial of service. Public references include Exploit-DB’s ...

CVE-2018-7182

The ctlgetitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service out-of-bounds read via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10...

gaku.ru XSS vulnerability

Open Bug Bounty ID: OBB-575178 Description| Value ---|--- Affected Website:| gaku.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

fi.iherb.com XSS vulnerability

Open Bug Bounty ID: OBB-574920 Description| Value ---|--- Affected Website:| fi.iherb.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosur...

Update Veeam MP Core Services to Support TLS 1.2 Protocol

Challenge Starting with vSphere 6.5, the TLS protocol version 1.2 is enabled by default. Cause To allow Veeam Virtualization Extensions Service and Veeam VMware Collectors to connect to vCenter Servers that use the TLS 1.2 protocol, you must update Veeam MP core services. Solution NOTE: The...

CVE-2018-7182

The ctlgetitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service out-of-bounds read via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10...

F5 Networks BIG-IP : Apache Tomcat 6.x vulnerability (K34341852)

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.67, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing /...

F5 Networks BIG-IP : Apache Tomcat 6.x vulnerability (K18174924)

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended...

CVE-2017-18213

In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4040)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4040 advisory. - gre: fix a possible skb leak Eric Dumazet Orabug: 26403972 CVE-2017-9074 - ipv6: Fix leak in ipv6gsosegment. David S. Miller Orabug: 26403972...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2018-4041)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4041 advisory. - KEYS: Remove keytype::match in favour of overriding default by matchpreparse Tim Tianyang Chen Orabug: 25757946 CVE-2017-6951 - tcp: initialize...

CVE-2017-15136

When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered system the previously registered system will lose access to updates including security updates...

CVE-2017-15136

CVE-2017-15136 is described across multiple connected sources as a design/logic flaw in Red Hat Satellite 6. When registering and activating a new system, if the new system’s hostname is later reset to match a previously registered system, the previously registered system may lose access to updat...

CVE-2017-15136

When registering a system with Satellite 6 a hostname must be specified. if an additional system is registered with the same hostname, the original system will stop receiving updates from Satellite 6. An attacker with administrative privileges to add systems to a Satellite 6 server could exploit...

Node.js third-party modules: `concat-with-sourcemaps` allocates uninitialized Buffers when number is passed as a separator

I would like to report an uninitialized Buffer allocation issue in concat-with-sourcemaps. It allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in unlikely setups where separator is attacker-controlled. Module module name:...

RHEL 6 : java-1.8.0-ibm (RHSA-2018:0352)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0352 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2018-0349)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0349 advisory. 1:1.7.0.171-2.6.13.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.171-2.6.13.0 - Bump to 2.6.13 and u171b01. - Update...