USN-2230-1: chkrootkit vulnerability

Thomas Stangner discovered that chkrootkit incorrectly quoted certain values. A local attacker could use this issue to execute arbitrary code when chkrootkit is run and gain root privileges...

USN-2226-1: Linux kernel vulnerabilities

Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory. CVE-2014-1738 Matthew Daley reported a flaw in the handling of ioctl commands by the floppy...

USN-2211-1: libXfont vulnerabilities

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges. CVE-2014-0209 Ilja van Sprundel discovered that libXfont incorrectly handled...

USN-2210-1: cups-filters vulnerability

Sebastian Krahmer discovered that cups-browsed incorrectly filtered remote printer names and strings. A remote attacker could use this issue to possibly execute arbitrary commands. CVE-2014-2707 Johannes Meixner discovered that cups-browsed ignored invalid BrowseAllow directives. This could cause...

USN-2204-1: Linux kernel vulnerability

A flaw was discovered in the Linux kernel's pseudo tty pty device. An unprivileged user could exploit this flaw to cause a denial of service system crash or potentially gain administrator privileges...

USN-2190-1: JBIG-KIT vulnerability

Florian Weimer discovered that JBIG-KIT incorrectly handled certain malformed images. If a user or automated system were tricked into processing a specially crafted image, JBIG-KIT could be made to crash, or possibly execute arbitrary code...

USN-2183-2: dpkg vulnerability

USN-2183-1 fixed a vulnerability in dpkg. Javier Serrano Polo discovered that the fix introduced a vulnerability in releases with an older version of the patch utility. This update fixes the problem. Original advisory details: Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks...

USN-2184-2: Unity vulnerabilities

USN-2184-1 fixed lock screen vulnerabilities in Unity. Further testing has uncovered more issues which have been fixed in this update. This update also fixes a regression with the shutdown dialogue. We apologize for the inconvenience. Original advisory details: Frédéric Bardy discovered that Unit...

USN-2184-1: Unity vulnerabilities

Frédéric Bardy discovered that Unity incorrectly filtered keyboard shortcuts when the screen was locked. A local attacker could possibly use this issue to run commands, and unlock the current session. Giovanni Mellini discovered that Unity could display the Dash in certain conditions when the...

CVE-2013-4815

HP ArcSight Enterprise Security Manager (ESM) is affected by CVE-2013-4815, a remote Cross-Site Scripting (XSS) vulnerability in the Management Web Interface. The flaw exists in ESM prior to version 5.5 and can allow an attacker to inject arbitrary web script or HTML through unspecified vectors i...

CVE-2013-4815

Cross-site scripting XSS vulnerability in the web interface in HP ArcSight Enterprise Security Manager ESM before 5.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Symantec Enterprise Security Manager/Agent Privilege Escalation Vulnerability

Symantec Enterprise Security Manager/Agent is prone to a local privilege escalation vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Path traversal

Multiple unquoted Windows search path vulnerabilities in the 1 Manager and 2 Agent components in Symantec Enterprise Security Manager ESM before 11.0 allow local users to gain privileges via unspecified vectors...

CVE-2012-4350

Multiple unquoted Windows search path vulnerabilities in the 1 Manager and 2 Agent components in Symantec Enterprise Security Manager ESM before 11.0 allow local users to gain privileges via unspecified vectors...

CVE-2012-4350

Symantec Enterprise Security Manager (ESM) for Windows is affected by CVE-2012-4350 due to an unquoted search path in both the Manager and Agent components, enabling local privilege escalation. Public sources (OpenVAS/Nessus entries) confirm the issue affects Windows and provide remediation: upgr...

CVE-2010-4099

ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess...

Design/Logic Flaw

ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess...

CVE-2010-4099

The CVE-2010-4099 issue affects NitroSecurity NitroView ESM 8.4.0a (ess.pm) when ESSPMDebug is enabled. It allows remote attackers to execute arbitrary commands by sending shell metacharacters in the Request parameter to ess. The vulnerability is triggered by improper handling of user-controlled ...

CVE-2010-4099

ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess...

NitroSecurity ESM 8.4.0a Remote Code Execution

-- Product description: NitroView ESM is an enterprise-class security information and event management system that identifies, correlates, and remediates threats faster than any other SIEM on the market. -- Problem Description: During research it was found that perl module "ess.pm" is prone to...