RHEL 7 : Satellite 6.3 (RHSA-2018:0336)

"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0336 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitorin...

Important: Red Hat Security Advisory: Satellite 6.3 security, bug fix, and enhancement update

An update is now available for Red Hat Satellite. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2018-6459

The rsapssparamsparse function in libstrongswan/credentials/keys/signatureparams.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that lacks a mask generation function parameter...

CVE-2018-6459

CVE-2018-6459 – strongSwan DoS in RSASSA-PSS parsing affected software/versions: strongSwan 5.6.1 (RSA-PSS signature parsing code in libstrongswan/credentials/keys/signature_params.c). root cause: the rsa_pss_params_parse function mishandles a missing mask generation function (MGF) parameter in R...

CVE-2018-6459

The rsapssparamsparse function in libstrongswan/credentials/keys/signatureparams.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that lacks a mask generation function parameter...

strongswan - Insufficient input validation in RSASSA-PSS signature parser

Strongswan Release Notes reports: Fixed a DoS vulnerability in the parser for PKCS1 RSASSA-PSS signatures that was caused by insufficient input validation. One of the configurable parameters in algorithm identifier structures for RSASSA-PSS signatures is the mask generation function MGF. Only MGF...

CVE-2017-6459

The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes...

CVE-2017-6459

CVE-2017-6459 affects the Windows installer for ntp prior to 4.2.8p10 and ntp 4.3.x prior to 4.3.94. The vulnerability allows local users to cause unspecified impact via vectors related to an argument with multiple null bytes. Public references confirm the ntp update path: 4.2.8p10 and 4.3.94 con...

CVE-2017-6459

The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes...

Cisco TelePresence CE and TC Software Command Injection Vulnerability (cisco-sa-20161102-tp)

Cisco TelePresence Endpoint is prone to local command injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-6459

Cisco TelePresence endpoints running CE or TC software are vulnerable to a local shell command injection when input is not properly sanitized. An authenticated, local attacker could exploit this to execute arbitrary commands. Fixed releases are 6.3.4, 7.3.7, 8.2.2, and 8.3.0. Affected releases in...

General Electric MDS PulseNET FileDownloadServlet Directory Traversal (CVE-2015-6459)

A directory traversal vulnerability exists in the General Electric MDS PulseNET products. The vulnerability is due to insufficient validation in FileDownloadServlet. An unauthenticated remote attacker can exploit this vulnerability to read and then delete an arbitrary file on the system...

CVE-2015-6459

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6459

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6459

CVE-2015-6459 covers an absolute path traversal in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise FileDownloadServlet prior to version 3.1.5. The vulnerability arises from insufficient validation in the download function, allowing remote attackers to read or delete arbitrary files via...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.0 and 5.1 allows remote attackers to affect availability via vectors related to SGD Proxy Server ttaauxserv, a different vulnerability than CVE-2014-2472, CVE-2014-2474, and CVE-2014-6459...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.0 and 5.1 allows remote attackers to affect availability via vectors related to SGD Proxy Server ttaauxserv, a different vulnerability than CVE-2014-2474, CVE-2014-2476, and CVE-2014-6459...

CVE-2014-6459

CVE-2014-6459 describes an unspecified vulnerability in the Oracle Secure Global Desktop component of Oracle Virtualization 5.0/5.1 that allows remote attackers to affect availability via the SGD Proxy Server (ttaauxserv). Connected sources confirm the affected product is Oracle SGD within Oracle...

Updated ruby-will_paginate package fixes CVE-2013-6459

Updated ruby-willpaginate packages fix security vulnerability: Cross-Site Scripting XSS vulnerabilities were found in willpaginate gem for Ruby, where certain input related to generated pagination links were not properly sanitised before being returned. This could be exploited to execute arbitrar...

MGASA-2014-0054 Updated ruby-will_paginate package fixes CVE-2013-6459

Updated ruby-willpaginate packages fix security vulnerability: Cross-Site Scripting XSS vulnerabilities were found in willpaginate gem for Ruby, where certain input related to generated pagination links were not properly sanitised before being returned. This could be exploited to execute arbitrar...