CVE-2018-16872

A flaw was found in qemu Media Transfer Protocol MTP. The code opening files in usbmtpgetobject and usbmtpgetpartialobject and directories in usbmtpobjectreaddir doesn't consider that the underlying filesystem may have changed since the time lstat2 was called in usbmtpobjectalloc, a classical...

VMware Tools Out-of-Bounds Read Vulnerability

VMware Tools is a set of enhancements that come with VMware's VMWare virtual machines. It is a set of drivers provided by VMware to enhance the performance of virtual graphics cards and hard drives, as well as to synchronize the clocks of the virtual machines with those of the host computer. An...

DEBIAN-CVE-2017-7471

Quick Emulator Qemu built with the VirtFS, host directory sharing via Plan 9 File System 9pfs support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system...

CVE-2017-7471

Quick Emulator Qemu built with the VirtFS, host directory sharing via Plan 9 File System 9pfs support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system...

GE MDS PulseNET and MDS PulseNET Enterprise Directory Traversal Vulnerability

GE MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric GE.GE MDS PulseNET is a suite of network management software designed specifically for radio communication systems.MDS PulseNET Enterprise is its enterprise version. A directory traversal vulnerability exists in GE...

Input validation

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host...

CVE-2016-9602

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host...

CVE-2016-9602

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host...

CVE-2016-9602

CVE-2016-9602 is tied to QEMU (qemu-kvm) built with VirtFS where, before version 2.9, a privileged guest user can trigger an improper link following to access the host filesystem outside the shared folder, potentially escalating privileges on the host. The connected EulerOS advisory confirms this...

CVE-2016-9602

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host...

Pivotal Garden Information Disclosure Vulnerability

Pivotal Garden is a containerized system from Pivotal Software, USA. A security vulnerability exists in the garden-linux nstar executable in Pivotal Garden versions 0.22.0-0.329.0. An attacker could exploit this vulnerability to access files on the host system...

CVE-2017-8158

FusionCompute V100R005C00 and V100R005C10 have an improper authorization vulnerability due to improper permission settings for a certain file on the host machine. An authenticated attacker could create a large number of virtual machine VM processes to exhaust system resources. Successful exploit...

Roundcube Webmail Arbitrary File Access Vulnerability

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A security vulnerability exists in Roundcube Webmail versions prior to 1.1.10, 1.2.x versions prior to 1.2.7, and 1.3.x versions prior to 1.3.3. An...

Huawei FusionCompute Denial of Service Vulnerability

Huawei FusionCompute is an enterprise-grade, open server virtualization solution from Huawei, China, based on the Xen open source design. The solution provides automation, advanced integration and management capabilities for virtualized data centers. A denial of service vulnerability exists in...

CVE-2017-5529

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition versions 6.4.0 and below, TIBCO JasperReports...

UBUNTU-CVE-2017-5529

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition versions 6.4.0 and below, TIBCO JasperReports...

CVE-2017-3141

The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2-9.2.9, 9.3.2-P1-9.3.6, 9.4.0-9.8.8, 9.9.0-9.9.10, 9.10.0-9.10.5, 9.11.0-9.11.1, 9.9.3-S1-9.9.10-S1,...

Directory Traversal

github.com/kubernetes/kubernetes is vulnerable to directory traversal attackers. The vulnerability exists because it does load the compacted seccomp json profile, allowing to load any file on the host...

Apache Ambari Remote Code Execution Vulnerability

Apache Ambari is a set of tools for configuring, managing and monitoring Apache Hadoop clusters from the Apache Software Foundation in the United States. The tool supports visualization and analysis of jobs and task execution, support for system alerts, etc. Ambari Agent is used as one of the...

Product security update: Virtuozzo 6.0 Update 12 Hotfix 2 (6.0.12-3658)

The new packages for Virtuozzo 6.0 introducing a security fix. Vulnerability id: PSBM-58425 A vulnerability within vzpkg could allow a malicious user to perform a basic symlink attack resulting in files being moved outside of the container and onto the host file system. The issue only affected...