OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)

It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with...

CVE-2017-16689

A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established to a different client or a different user on the same system, although no explicit Trusted/Trusting...

Arbitrary Code Execution As A Different User

storm-core is vulnerable to arbitrary code execution as a different user. The vulnerability is possible due to a flaw which allows a topology owner to mislead the supervisor to run a worker as a different user i.e., non-root. In the worst case, this exposes all the credentials of the user...

[DLA 30-1] acpi-support security update

Package : acpi-support Version : 0.137-5+deb6u1 CVE ID : CVE-2014-1419 CESG discovered a race condition in acpi-support which may allow an unprivileged user to execute arbitrary code as a different user, including root...

Kahua vulnerable in allowing to share login sessions

Overview Kahua is an open source application development and runtime environment server. Kahua contains a vulnerability which allows the sharing of sessions among multiple applications which are referring to different user databases. Impact A remote attacker could possibly take over the user...

Design/Logic Flaw

The Korn shell aka mksh before R33d on MirOS aka MirBSD does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a...