ProFTPD < 1.3.2b / 1.3.3x < 1.3.3rc2 client-hostname restriction bypass

The remote host is using ProFTPD, a free FTP server for Unix and Linux. According to its banner, the version of ProFTPD installed on the remote host is 1.3.2x prior to 1.3.2b or 1.3.3x prior to 1.3.3rc2 and is affected by a mitigation bypass vulnerability when the dNSNameRequired TLS option is...

CVE-2018-6764

util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module...

UBUNTU-CVE-2018-6764

util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module...

Code injection

htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter...

Dnsmasq Security Bypass Vulnerability

Dnsmasq is the software developer Simon Kelley developed a use of C language written in open source lightweight DNS forwarding and DHCP, TFTP server . A security bypass vulnerability exists in the DNSSEC implementation in Dnsmasq 2.78 and earlier versions. An attacker could exploit this...

The vulnerability of the centralized version control system CVS lies in its improper handling of data when interacting with a remote repository via SSH protocol. This allows a malicious actor to execute arbitrary code.

The vulnerability of the centralized version control system CVS is related to improper data processing when interacting with a remote repository via SSH protocol. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted hostname in the repository’...

CVE-2017-15107

A vulnerability was found in Dnsmasq's implementation of DNSSEC. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist...

Keybase: Keybase extension hostname-validation regular expression issue.

Description The following snippet in js/identities.js allows all hostnames ending in twitter.com, facebook.com, etc. to display the Keybase message window. The issue stems from the fact that you use . instead of \. in your regular expression. js service: "twitter", getUsername: functionloc return...

Fedora 27 : krb5 (2017-7a22a80c7e)

Prevent applications from accidentally implementing CVE-2017-11462 double free if seccontext is copied. - fc26+: Add ccselect hostrealm module for ccache selection based on service hostname. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

CVE-2018-2362

A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname...

Information disclosure

A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname...

CVE-2018-2362

A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

DEBIAN-CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

MGASA-2018-0017 Updated libvirt packages fix security vulnerability

In virsh, the hostname could crafted maliciously with ssh arguments, which would be passed to ssh bsc1053600...

Updated libvirt packages fix security vulnerability

In virsh, the hostname could crafted maliciously with ssh arguments, which would be passed to ssh bsc1053600...

GitHub Git LFS Arbitrary Command Execution Vulnerability

GitHub Git LFS is a U.S. GitHub company developed an open source project . GitHub Git LFS for version control of large files in the open source Git extension . An arbitrary command execution vulnerability exists in GitHub Git LFS versions prior to 2.1.1. The vulnerability can be exploited by remo...

CVE-2017-17831

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository...

UBUNTU-CVE-2017-17831

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository...

The vulnerability of the Apache HttpClient client module of Apache HttpComponents (http/impl/client/HttpClientBuilder.java) allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Apache HttpClient client module of the Apache server http/impl/client/HttpClientBuilder.java is related to insufficient validation of input data X509HostnameVerifier. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity,...