Design/Logic Flaw

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture FFDC service log. The FFDC...

PT-2021-7348

Name of the Vulnerable Software and Affected Versions BIND versions 9.11.0 through 9.11.36 BIND versions 9.12.0 through 9.16.26 BIND versions 9.17.0 through 9.18.0 BIND Supported Preview Editions versions 9.11.4-S1 through 9.11.36-S1 BIND Supported Preview Editions versions 9.16.8-S1 through...

SAD DNS — New Flaws Re-Enable DNS Cache Poisoning Attacks

A group of academics from the University of California and Tsinghua University has uncovered a series of critical security flaws that could lead to a revival of DNS cache poisoning attacks. Dubbed "SAD DNS attack" short for Side-channel AttackeD DNS, the technique makes it possible for a maliciou...

Linux: SSH AllowAgentForwarding

AllowAgentForwarding: Specifies whether ssh-agent forwarding is permitted. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions...

CVE-2017-18437

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...

CVE-2017-18437

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...

Code injection

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...

CVE-2017-18437

CVE-2017-18437 affects cPanel prior to 64.0.21, where a Webmail account can execute code via forwarders (SEC-240). Impact is code execution with Webmail privileges; CVSS data shows LOW to MEDIUM base scores (C/L/I/P). Remediation: upgrade to 64.0.21 or newer to fix the vulnerability. Other detail...

CVE-2017-18437

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...

CVE-2016-10816

cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders SEC-121...

Design/Logic Flaw

cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders SEC-121...

Splunk Enterprise 6.x < 6.0.1 Malformed Packet DoS

According to its version number, the Splunk Enterprise hosted on the remote web server may be affected by a denial of service vulnerability that is triggered by malformed network input, resulting in the Splunk server becoming unavailable. Note that this only affects Splunk Enterprise 6.0 componen...