2937 matches found
DefectDojo - Application Vulnerability Correlation And Security Orchestration Application
DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, schedule scans, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one...
corosync, corosynclib security update
CentOS Errata and Security Advisory CESA-2018:1169 An update for corosync is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...
Nanopool Claymore Dual Miner APIs RCE
This module takes advantage of miner remote manager APIs to exploit an RCE vulnerability. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nanopool Claymore Dual Miner APIs RCE', 'Description' =...
Remote code execution
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...
CVE-2017-2608
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...
CVE-2017-2608
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...
CVE-2017-2608
CVE-2017-2608 is a remote-code-execution vulnerability in Jenkins via deserialization in XStream-based APIs (javax.imageio). Affected are Jenkins versions before 2.44 and 2.32.2 (as listed in multiple advisories). The flaw arises from improper validation of user-supplied input before deserializat...
CVE-2017-2608
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...
Wallarm Node — now as a Google Cloud image
Today we’re excited to announce native availability of Wallarm Node image for Google Cloud Platform GCP. Many Wallarm customers and prospects use Google Cloud for its high-performance, scalable infrastructure with excellent price/performance. The ability to customize machine types to customer...
IBM API Connect Security Bypass Vulnerability (CNVD-2018-09233)
IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in LoopBack APIs for a Model created in IBM API Connect. An attacker...
Tens of Thousands of Malicious Apps Using Facebook APIs
At least 25,936 malicious apps are currently using one of Facebook’s APIs, such as a login API or messaging API. These allow apps to access a range of information from Facebook profiles, like name, location and email address. Trustlook discovered the malicious apps using a formula, which created ...
CVE-2018-1389
IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing unauthorized modification of information. IBM X-Force ID: 138213...
CVE-2018-1389
IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing unauthorized modification of information. IBM X-Force ID: 138213...
Microsoft Windows 10: Create a token object
This policy setting determines which accounts a process can use to create a token, and which accounts it can then use to gain access to local resources when the process uses NtCreateToken or other token-creation APIs. OpenVAS Vulnerability Test $Id: win10createtokenobject.nasl 11532 2018-09-21...
[SECURITY] Fedora 27 Update: corosync-2.4.4-1.fc27
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
CVE-2016-10486
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, and SD 820A, PD failure reason string from user PD is used directly in root PD, s...
Buffer overflow
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, and SD 820A, PD failure reason string from user PD is used directly in root PD, s...
CVE-2016-10486
CVE-2016-10486 affects Android devices with Qualcomm Snapdragon Wireless/Automotive SoCs (e.g., MDM9640/9645, SD 210/212/205, 450, 617, 625, 650/52, 808, 810, 820, 820A, etc.). The root cause is that the PD failure reason string from user PD is used directly in root PD; if the buffer in Diag F3 A...
CVE-2016-10448
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD...
PT-2018-15830 · Oracle +4 · Java Se +7
Name of the Vulnerable Software and Affected Versions: Java SE versions 6u181, 7u171, 8u162, and 10 Java SE Embedded version 8u161 JRockit version R28.3.17 Description: The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded,...