Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3676-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3676-2 advisory. USN-3676-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

USN-3663-1 haproxy vulnerability

It was discovered that HAProxy incorrectly handled certain resquests. An attacker could possibly use this to expose sensitive information...

CVE-2017-9284

IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information...

CVE-2017-1758: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager for ACH Services for Multi-Platform IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender Advanced 9.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A...

CVE-2017-15712

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host...

NetGain Enterprise Manager download Arbitrary File Download Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within download.jsp. The issue results from the lack of proper validation ...

CVE-2017-7930: Improper Authentication

An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Data Archive has protocol flaws with the potential to expose change records in the clear and allow a malicious party to spoof a server within a collective...

Schneider Electric U.motion Builder runscript directory traversal vulnerability

U.motion Builder is a builder product from Schneider Electric France. A directory traversal vulnerability exists in the Schneider Electric U.motion Builder runscript. When handling the 's' parameter of a small application. An attacker could exploit the vulnerability to expose files from the syste...

Shodan’ Malware Hunter to Expose Command & Control Centers of Botnets

By Jahanzaib Hassan Recorded Future, a threat intelligence company together with Shodan, which is an internet search engine connecting services to internet devices, have created an online crawler which they call the Malware Hunter. What does it do? The Malware Hunter is a program that sends out...

CVE-2017-3429

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network...

Google Chrome < 54.0.2840.99 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 54.0.2840.99. It is, therefore, affected by multiple vulnerabilities as referenced in the 201611stable-channel-update-for-desktop9 advisory. - browser/extensions/api/dial/dialregistry.cc in Google Chrome before...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information

The multiple vulnerabilities in the linux-image-2.6.18-6-r4k-ip22 package of the Debian GNU/Linux operating system may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the Simatic WinCC software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The implementation of SQL code on the Web Navigator system’s input screen allows malicious actors operating remotely to execute arbitrary SQL commands...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information

The multiple vulnerabilities in the linux-headers-2.6.26-2-sb1a-bcm91480b package of the Debian GNU/Linux operating system may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities in the Debian GNU/Linux operating system that allow a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information

Multiple vulnerabilities in the linux-headers-2.6.24-etchnhalf.1-all-hppa package of the Debian GNU/Linux operating system. Its operation may lead to violations of confidentiality, integrity, and accessibility of protected information...

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2948-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2948-1 advisory. Ralf Spenneberg discovered that the USB driver for Clie devices in the Linux kernel did not properly validate the endpoints reported by the device. An...

jenkins: Project name disclosure via fingerprints (SECURITY-153)

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request...

The vulnerabilities of PDF editing programs like Adobe Acrobat and Adobe Acrobat Document Cloud, as well as PDF viewing programs like Adobe Reader and Adobe Reader Document Cloud, allow attackers to circumvent existing restrictions and gain access to protected information.

The vulnerabilities of PDF editing programs like Adobe Acrobat and Adobe Acrobat Document Cloud, as well as PDF viewing programs like Adobe Reader and Adobe Reader Document Cloud, are related to lack of access control mechanisms. Exploiting these vulnerabilities can allow attackers to bypass...

AsHttp - Shell Command to Expose any other Command as HTTP

ashttp provide a simple way to expose any shell command by HTTP. For example, to expose top by HTTP, try : ashttp -p8080 top ; then try http://localhost:8080. Dependencies ashttp depends on hlvt100, a headless VT100 emulator. To get and compile hlvt100 : $ git clone...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information

The kernel-image-2.4.27-2-s390-tape package of the Debian GNU/Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...