Implementing the CIS 20 Critical Security Controls: Delving into More Sophisticated Techniques

Corden Pharma needed a standardized security program to meet customer requirements. Link3 Technologies wanted to prioritize its network security improvements. Telenet was looking for a road map to implement its ISO-27000 compliance program. These three companies — a German pharmaceutical contract...

[SECURITY] Fedora 27 Update: ansible-2.4.1.0-2.fc27

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

[SECURITY] Fedora 25 Update: ansible-2.4.1.0-2.fc25

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

[SECURITY] Fedora 26 Update: ansible-2.4.1.0-2.fc26

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

Moderate: Red Hat Security Advisory: ansible security, bug fix, and enhancement update

An update for ansible is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

中兴集成多业务路由器-ZXR10 1800-2S 敏感信息泄露漏洞

介绍 ZXR10 1800-2S 路由器是中兴通讯推出的集路由、交换、无线、安全、 VPN 于一体的智能集成多业务路由器产品，凭借模块化、可扩展的系统架构，为用户构建智能、高效、可靠、灵活、易维的网络。 该路由器可广泛灵活的适用于大客户接入、 DCN、园区网、校园网、政企网的出口网关、企业的总部/分支接入、金融网点、移动办公室、行业网纵向网的汇聚/接入等网络。 CVE/CNVD/CNNVD & 厂商回应 CVE-2017-10930...

CVE-2017-1000104

CVE-2017-1000104 concerns the Jenkins Config File Provider Plugin, which manages configuration files that may include secrets. The issue arises from insufficient access control: users with only Overall/Read access could view URLs to configuration files, until permissions were tightened to require...

How You Respond Can Make All the Difference

Part Three of a Three Part Series As the narrative on the Equifax compromise evolves, the general public, politicians, and speculators continue to seek blame for what happened. Was it an unpatched vulnerability? Was Equifax not following proper configuration management? Was management derelict in...

The vulnerability of the ScheduleQuery method in the scheduling class of the ZENworks Configuration Management information system allows a perpetrator to execute arbitrary SQL commands.

The vulnerability of the ScheduleQuery method in the ZENworks Configuration Management software framework relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands using undefined vectors...

The vulnerability of the doPost method in the Rtrlet class of the ZENworks Configuration Management information system allows a perpetrator to load and execute arbitrary files.

The vulnerability of the doPost method in the Rtrlet class of the ZENworks Configuration Management software lies in the deficiencies in path name restriction. Exploiting this vulnerability allows a malicious actor to download and execute arbitrary files using unspecified vectors...

The vulnerability of the Preboot Policy service of the information system management software ZENworks Configuration Management allows a perpetrator to execute arbitrary code.

The vulnerability of the Preboot Policy service in the information system management software ZENworks Configuration Management ZCM is caused by a buffer overflow in the stack. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2015-0780

SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management ZCM allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-0784

Rtrlet.class in Novell ZENworks Configuration Management ZCM allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable...

Code injection

com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management ZCM allows remote attackers to read arbitrary folders via the dirname variable...

Directory traversal

Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management ZCM allows remote attackers to upload and execute arbitrary files via unspecified vectors...

CVE-2015-0781

Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management ZCM allows remote attackers to upload and execute arbitrary files via unspecified vectors...

CVE-2015-0783

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

Design/Logic Flaw

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

Design/Logic Flaw

Rtrlet.class in Novell ZENworks Configuration Management ZCM allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable...

Sql injection

SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management ZCM allows remote attackers to execute arbitrary SQL commands via unspecified vectors...