118 matches found
Apache Tomcat 8.0.0.RC1 < 8.0.53 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 8.0.53. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.0.53security-8 advisory. - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by...
Fixed in Apache Tomcat 9.0.10
Low: host name verification missing in WebSocket client CVE-2018-8034 The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. This was fixed in revision 1833757. This issue was reported publicly on 11 June 2018 and formally announced as a...
CVE-2017-8034
The Cloud Controller and Router in Cloud Foundry CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267 do not validate the issuer on JSON Web Tokens JWTs from UAA. With certain multi-zone UAA configurations, zone administrators...
CVE-2017-8034
CVE-2017-8034 affects Cloud Foundry components: Cloud Controller and Router in CAPI release capi < v1.32.0, Routing-release < v0.159.0, CF-release
CVE-2016-8034
CVE-2016-8034 is rejected/not used; this entry does not correspond to an active vulnerability.
elita (>=0.60.0 <=0.64.1) potentially affected by CVE-2015-8034 via salt (=2014.1.10)
salt PYPI version =2014.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on salt and may be impacted: - elita =0.60.0, =0.64.1 Source cves: CVE-2015-8034 Source advisory: OSV:PYSEC-2017-32...
CVE-2015-8034
Removed by vendor...
CVE-2015-8034
CVE-2015-8034 affects Salt before version 2015.8.3, where the state.sls function stores cache data with weak permissions, allowing local attackers to read sensitive information. Connected sources confirm the underlying issue and note remediation via upgrading to Salt 2015.8.3 or later. If upgradi...
openSUSE Security Update : virtualbox (openSUSE-2016-1087)
Virtualbox was updated to 5.0.26 to fix the following issues : This update fixes various security issues. - CVE-2016-3612: An unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.22 allowed remote attackers to affect confidentiality via...
SUSE-SU-2016:1896-1 Security update for salt
salt was updated to fix one security issue. This security issue was fixed: - CVE-2015-8034: Prevent saving state.sls cache data to disk with insecure permissions bsc957914...
SUSE-SU-2016:1895-1 Security update for salt
salt was updated to fix one security issue. This security issue was fixed: - CVE-2015-8034: Prevent saving state.sls cache data to disk with insecure permissions bsc957914...
SUSE-SU-2016:1897-1 Security update for salt
salt was updated to fix one security issue. This security issue was fixed: - CVE-2015-8034: Prevent saving state.sls cache data to disk with insecure permissions bsc957914...
Fedora 22 : salt-2015.5.9-2.fc22 (2016-c1fd651bc0)
Updated dnf patch ---- Update to bugfix release 2015.5.9, patched with proper dnf support Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...
FreeBSD : Salt -- information disclosure (e6b974ab-9d35-11e5-8f5c-002590263bf5)
Salt release notes report : CVE-2015-8034: Saving state.sls cache data to disk with insecure permissions This affects users of the state.sls function. The state run cache on the minion was being created with incorrect permissions. This file could potentially contain sensitive data that was insert...
Salt -- information disclosure
Salt release notes report: CVE-2015-8034: Saving state.sls cache data to disk with insecure permissions This affects users of the state.sls function. The state run cache on the minion was being created with incorrect permissions. This file could potentially contain sensitive data that was inserte...
CVE-2014-8034
Cisco WebEx Meetings Server 1.5 is affected by CVE-2014-8034 due to a login CAPTCHA that does not refresh between attempts, enabling unauthenticated remote attackers to perform brute-force username guessing and enumerate valid accounts. Cisco’s advisory confirms the vulnerability and that updated...