CVE-2020-10695

An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to modify the /etc/passwd and escalate their privileges...

Code injection

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user...

Code injection

redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "Billion Laugh Attack" by replying to XMLRPC methods when getting the status of an host...

CVE-2018-10867

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user...

CVE-2018-10867

CVE-2018-10867 affects Red Hat redhat-certification 7. The flaw is an access-control error on the /update/results page, allowing a remote attacker to delete any file accessible by the user running httpd (apache). Root cause: insufficient access restriction for update results. Impact: potential da...

CVE-2018-10863

CVE-2018-10863 affects redhat-certification 7, where improper configuration allows listing all files/directories under /var/www/rhcert/store/transfer via the /rhcert-transfer URL, enabling information disclosure. The impact is exposure of sensitive information, per multiple connected records. Exp...

RHEL 7 / 8 : OpenShift Container Platform 4.6.30 (RHSA-2021:1566)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1566 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

RHEL 7 / 8 : OpenShift Container Platform 4.5.40 (RHSA-2021:2057)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2057 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

Audio equipment giant Bose hit by ransomware attack, data breach

By Deeba Ahmed The audio equipment manufacturer Bose has confirmed that it was a victim of a ransomware attack and experience a data breach on 7 March 2021. This is a post from HackRead.com Read the original post: Audio equipment giant Bose hit by ransomware attack, data breach...

ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path

Exploit Title: ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path Discovery by: Emmanuel Lujan Discovery Date: 2021-05-22 Vendor Homepage: https://www.acer.com Tested Version: 6.0.3008.0 Vulnerability Type: Unquoted Service Path Tested on OS: Windows 7 Home Premium x64 Step to discover...

Updated bind packages fix security vulnerabilities

A broken inbound incremental zone update IXFR can cause named to terminate unexpectedlyCVE-2021-25214. Mageia 7 version not affected. An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself CVE-2021-25215. This affects both...

ePowerSvc 6.0.3008.0 Unquoted Service Path

Exploit Title: ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path Discovery by: Emmanuel Lujan Discovery Date: 2021-05-22 Vendor Homepage: https://www.acer.com Tested Version: 6.0.3008.0 Vulnerability Type: Unquoted Service Path Tested on OS: Windows 7 Home Premium x64 Step to discover...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 7 (Moderate) (RHSA-2021:2047)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2047 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.7 security update on RHEL 7

New Red Hat Single Sign-On 7.4.7 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2020-15522 vulnerabilities

Vulnerabilities for packages: hadoop-fips, elasticsearch...

Acer Updater Service 1.2.3500.0 Unquoted Service Path

Exploit Title: Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe' Unquoted Service Path Discovery by: Emmanuel Lujan Discovery Date: 2020-11-26 Vendor Homepage: https://www.acer.com/ac/en/US/content/home Tested Version: 1.2.3500.0 Vulnerability Type: Unquoted Service Path Tested on OS: Window...

Acer Backup Manager Module 3.0.0.99 Unquoted Service Path

Exploit Title: Acer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path Discovery by: Emmanuel Lujan Discovery Date: 2021-05-19 Vendor Homepage: https://www.acer.com/ac/en/US/content/home Tested Version: 3.0.0.99 Vulnerability Type: Unquoted Service Path Tested on OS: Window...

Oracle Linux 7 : xorg-x11-server (ELSA-2021-2033)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2033 advisory. 1.20.4-16 - CVE fix for: CVE-2021-3472 1944956 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

RHEL 7 / 8 : OpenShift Container Platform 4.7.11 (RHSA-2021:1551)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1551 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

Oracle Linux 7 : slapi-nis (ELSA-2021-2032)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-2032 advisory. 0.56.5-4 - CVE 2021-3480: slapi-nis: NULL dereference DoS with specially crafted Binding DN - Resolves: rhbz1942937 Tenable has extracted the preceding...