RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2017:3392)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3392 advisory. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security...

support.knu.ac.kr XSS vulnerability

Open Bug Bounty ID: OBB-449583 Description| Value ---|--- Affected Website:| support.knu.ac.kr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

CVE-2017-15121

CVE-2017-15121 describes a local Linux kernel vulnerability where a non-privileged user can mount a fuse filesystem on RHEL 6/7 and crash the system if an application writes through a hole in a file not aligned to a page boundary. Connected advisories/plugins (e.g., Red Hat RHSA entries and F5/BI...

Oracle Linux 6 / 7 : firefox (ELSA-2017-3382)

The remote Oracle Linux 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2017-3382 advisory. 52.5.1-1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper upda...

PT-2017-13877 · Red Hat +1 · Rhel +2

Name of the Vulnerable Software and Affected Versions: RHEL versions 6 and 7 Description: A non-privileged user can crash a system by mounting a fuse filesystem and exploiting an issue related to file hole punching that does not end aligned to a page boundary. Recommendations: For RHEL version 6,...

CVE-2017-15121

A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary...

Product update: Virtuozzo 7.0 Update 6 Hotfix 1 (7.0.6-678)

The Hotfix 1 for Virtuozzo 7.0 Update 6 provides stability and usability bug fixes. Vulnerability id: PSBM-72443 Migration of a VM with two HDDs from Virtuozzo 6 to 7 could fail due to a libvirt conversion failure. Vulnerability id: PSBM-77096 vstorage-mount could crash under certain conditions d...

RHEL 6 / 7 : firefox (RHSA-2017:3382)

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:3382 advisory. Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 52.5.1 ESR. Security Fixes: A privacy flaw was discovered ...

RHEL 6 : kernel-rt (RHSA-2017:3295)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:3295 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Securi...

CentOS Update for apr CESA-2017:3270 centos6

Check the version of apr SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882807";...

MGASA-2017-0437 Updated nagios packages fix security vulnerability

It was found that nagios daemon creates its PID file after dropping privileges, which allows to change its content by non-root user with PID of any other process, resulting into denial-of-service when daemon is stopped CVE-2017-12847. Note that the nagios package on Mageia 5 is no longer supporte...

Updated nagios packages fix security vulnerability

It was found that nagios daemon creates its PID file after dropping privileges, which allows to change its content by non-root user with PID of any other process, resulting into denial-of-service when daemon is stopped CVE-2017-12847. Note that the nagios package on Mageia 5 is no longer supporte...

EMC RSA Authentication Manager < 8.2 SP1 Patch 6 Stored Cross-Site Scripting (ESA-2017-152)

The version of EMC RSA Authentication Manager running on the remote host is prior to 8.2 SP1 Patch 6 8.2.1.6. It is, therefore, affected by an unspecified stored cross-site scripting vulnerability. Attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code...

Updated mediawiki packages fix security vulnerabilities

XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping CVE-2017-8808. Reflected File Download from api.php CVE-2017-8809. On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password CVE-2017-8810. It's possible to...

RHEL 6 : samba4 (RHSA-2017:3278)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3278 advisory. Samba is an open-source implementation of the Server Message Block SMB or Common Internet File System CIFS protocol, which allows...

RHEL 6 : java-1.8.0-ibm (RHSA-2017:3267)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3267 advisory. - lcms2: Out-of-bounds read in TypeMLURead CVE-2016-10165 - OpenJDK: multiple unbounded memory allocations in deserialization Serialization,...

Oracle Linux 6 / 7 : apr (ELSA-2017-3270)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3270 advisory. 1.3.9-5.1 - Resolves: 1507346 - CVE-2017-12613 apr: Out-of-bounds array deref in aprtimeexp functions Tenable has extracted the preceding description block...

CentOS 6 / 7 : apr (CESA-2017:3270)

An update for apr is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

JBOSSAS 5.x/6.x Deserializer Vulnerability

Exploit for java platform in category web applications JBOSSAS 5.x/6.x Deserializer Vulnerability https://access.redhat.com/security/cve/cve-2017-12149 CVE-2017-12149 It was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it...

ubuy.ae XSS vulnerability

Vulnerable URL: https://www.ubuy.ae/en/search/?cat=name==US-store='-confirm/OPENBUGBOUNTY/-' Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 132791 VIP website status:| No Coordinated Disclosure Timeline:...