Oracle Hospitality Cruise Fleet Management Remote Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers, and storage solutions for hospitality management from Oracle Corporation. Oracle Hospitality Cruise Fleet Management is one of the fleet management components of Oracle Hospitality Cruise Fleet Management, which provide...

CVE-2017-1327

IBM iNotes versions 8.5 and 9.0 are affected by a cross-site scripting (XSS) vulnerability in the Web UI. The issue allows an attacker to embed arbitrary JavaScript, potentially altering functionality and leading to credentials disclosure within a trusted session. Connected documents corroborate ...

Debian DSA-3924-1 : varnish - security update

A denial of service vulnerability was discovered in Varnish, a state of the art, high-performance web accelerator. Specially crafted HTTP requests can cause the Varnish daemon to assert and restart, clearing the cache in the process. See https://varnish-cache.org/security/VSV00001.html for detail...

Design/Logic Flaw

IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257...

CVE-2016-9981

CVE-2016-9981 affects IBM AppScan Enterprise Edition 9.0. The available documents describe an unspecified vulnerability that could allow an attacker to hijack a valid user’s session. No concrete root-cause, affected component details, exploit vectors, or remediation steps are provided in the sour...

Cross site scripting

IBM WebSphere Portal and Web Content Manager 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2017-1332

CVE-2017-1332 affects IBM iNotes 8.5 and 9.0, where a cross-site scripting flaw in the Web UI can allow an attacker to inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Public data shows CVSS scores (NVD) of 6.1 (CVSS3.0) and 4.3 (CVSS2.0); explo...

SGX Update

Summary: Intel has released updates that improve the security of Intel® Software Guard Extensions Intel® SGX. Description: Intel has released updates that improve the security of Intel® Software Guard Extensions Intel® SGX. The improvement applies to 6th and 7th Generation Intel® Core™ Processor...

CVE-2017-1318

IBM MQ Appliance 8.0 (8.0.0.0–8.0.0.6) and 9.0.x CD releases (9.0.1–9.0.2) are affected by CVE-2017-1318, where an authenticated messaging administrator could execute arbitrary commands on the appliance due to a command-execution flaw. The IBM Security Bulletin confirms the affected versions and ...

Debian DSA-3911-1 : evince - security update

Felix Wilhelm discovered that the Evince document viewer made insecure use of tar when opening tar comic book archives CBT. Opening a malicious CBT archive could result in the execution of arbitrary code. This update disables the CBT format entirely. %NASLMINLEVEL 70300 C Tenable Network Security...

Debian DSA-3905-1 : xorg-server - security update

Two security issues have been discovered in the X.org X server, which may lead to privilege escalation or an information leak. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3905. The tex...

IBM WebSphere MQ and IBM MQ Appliance Denial of Service Vulnerability

IBM WebSphere MQ and IBM MQ Appliance are both products of IBM Corporation, U.S.A. IBM WebSphere MQ is a messaging middleware product of IBM Corporation, U.S.A.; IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware. A security vulnerability...

CVE-2017-1217

IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123857...

CVE-2017-1217

CVE-2017-1217 affects IBM WebSphere Portal 8.5 and 9.0, where improper handling of user input enables cross-site scripting in the Web UI, potentially allowing an attacker to inject JavaScript and cause credentials disclosure within a trusted session. The provided documents do not specify a patch ...

CVE-2016-5045

CVE-2016-5045 affects NetApp OnCommand System Manager before 9.0. A remote attacker can obtain sensitive credentials via vectors related to cluster peering setup. The connected documents confirm the affected product and impact; no exploitation details are provided, and remediation steps are not s...

CentOS Update for emacs-mercurial CESA-2017:1576 centos7

Check the version of emacs-mercurial SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882746";...

Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64 Stack Clash' Local Privilege Escalation

/ Linuxldsohwcap64.c for CVE-2017-1000366, CVE-2017-1000379 Copyright C 2017 Qualys, Inc. myimportanthwcaps adapted from elf/dl-hwcaps.c, part of the GNU C Library: Copyright C 2012-2017 Free Software Foundation, Inc. This program is free software: you can redistribute it and/or modify it under t...

Debian DSA-3895-1 : flatpak - security update

It was discovered that Flatpak, an application deployment framework for desktop apps insufficiently restricted file permissinons in third-party repositories, which could result in privilege escalation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-3890-1 : spip - security update

Emeric Boit of ANSSI reported that SPIP, a website engine for publishing, insufficiently sanitises the value from the X-Forwarded-Host HTTP header field. An unauthenticated attacker can take advantage of this flaw to cause remote code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2017-1117

CVE-2017-1117 affects IBM WebSphere MQ (formerly WebSphere MQ) 8.0 and 9.0. An authenticated user can cause a denial of service on the MQXR channel when trace is enabled. Public docs (IBM bulletin) list affected versions and fixed levels: WebSphere MQ 7.5.0.0–7.5.0.7 are fixed by 7.5.0.8; MQ 8.0....