CVE-2018-8755

The CVE-2018-8755 issue affects NuCom NC-WR644GACV routers with firmware STA 005 and earlier, where an unauthenticated attacker can download the device configuration file, exposing admin credentials, WPA keys, and other config data. Root cause is an authentication/authorization bypass that allows...

sssd and ding-libs security and bug fix update

ding-libs 0.4.0-13 - Resolves: rhbz1538061 - sssd/libiniconfig cannot parse configuration file with line longer than 5102 0.4.0-12 - Related: rhbz1377213 - ding-libs dont parse lines without an equal sign sssd 1.13.3-60.0.1 - Orabug 26746822 - revert patch 0118 to fix LDAP netgroup lookup problem...

Magento Hackers Using Simple Evasion Trick to Reinfect Sites With Malware

Security researchers have been warning of a new trick that cybercriminals are leveraging to hide their malicious code designed to re-introduce the infection to steal confidential information from Magento based online e-commerce websites. So, if you have already cleaned up your hacked Magento...

CVE-2018-9022

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file...

Authentication flaw

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file...

CVE-2018-9022

CVE-2018-9022 affects Broadcom CA Privileged Access Manager up to version 2.8.2 and earlier. The vulnerability is an authentication bypass that allows a remote attacker to execute arbitrary code or commands by poisoning a configuration file. Public references document this as a remote command exe...

CVE-2018-9022

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file...

Security Bulletin: Vulnerability in SSLv3 affects Warehouse Administration Console and Cubing Services components of IBM InfoSphere Warehouse and IBM DB2 for Linux, Unix and Windows (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. IBM InfoSphere Warehouse and IBM DB2 for Linux, Unix and Windows do not directly enable SSLv3. However, WAS WebSphere Application Server is bundled with IBM...

PE client tools for Windows code execution vulnerability

Puppet is a set of configuration management tools based on the client/server C/S architecture of Puppet Labs, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version.PE client tools for Windows is one of the...

CVE-2018-12356

An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension script...

CVE-2018-6516

On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools aka pe-client-tools 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation...

CVE-2018-6516

On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools aka pe-client-tools 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation...

CVE-2017-17443

OPC Foundation Local Discovery Server LDS 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by placing invalid data into the configuration file. This vulnerability requires an attacker with access to the file system where the...

CVE-2017-17443

OPC Foundation Local Discovery Server LDS 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by placing invalid data into the configuration file. This vulnerability requires an attacker with access to the file system where the...

CVE-2017-17443

The CVE-2017-17443 entry concerns OPC Foundation Local Discovery Server (LDS) 1.03.370. A security update is required to address vulnerabilities that allow an attacker with local file-system access to place invalid data in the configuration file, causing the LDS to crash or become unavailable unt...

Puppet Agent Arbitrary Code Execution Vulnerability

Puppet is the United States Puppet Labs a set of client / server C / S architecture based on the configuration management tools . Puppet Agent for Windows is one of the Windows platform based on the agent program . A security vulnerability exists in Puppet Agent for Windows versions 1.10.x prior ...

Privilege escalation

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation...

[SECURITY] Fedora 27 Update: remctl-3.14-1.fc27

remctl the client and remctld the server implement a client/server protocol for running single commands on a remote host using Kerberos v5 authentication and returning the output. They use a very simple GSS-API-authenticated network protocol, combined with server-side ACL support and a server...

CVE-2018-6515

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation...

OCaml Batteries Included Parameter Injection Vulnerability

OCaml Batteries Included a.k.a. ocaml-batteries is a set of development platforms based on the OCaml language maintained by the OCaml community. A security vulnerability exists in the batteriesConfig.mlp file in OCaml Batteries Included version 2.6, which stems from the program failing to validat...