Citrix XenServer Multiple Vulnerabilities (CTX228867)

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities as noted in the CTX228867 advisory. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid103927; scriptversion"1.7";...

Citrix XenServer Multiple Security Updates (CTX228867)

A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to compromise the host. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

NXP Semiconductors MQX RTOS contains multiple vulnerabilities

Overview The NXP Semiconductors MQX RTOS prior to version 5.1 contains a buffer overflow in the DHCP client, which may lead to memory corruption allowing an attacker to execute arbitrary code, as well as an out of bounds read in the DNS client which may lead to a denial of service. Description Th...

Product update: Virtuozzo Automator 7.0 Update 2 Hotfix 3 (VA MN: 7.0.2-510, VA Agent: 7.0.2-258)

This hotfix for Virtuozzo Automator 7.0.2 provides new features as well as stability and usability bug fixes. Vulnerability id: PVA-34527 Alert reason would not be shown on clicking the alert icon on the virtual environment or hardware node summary page if the corresponding event had already been...

Product update: Virtuozzo 7.0 Update 5 Hotfix 4 (7.0.5-656)

The Hotfix 4 for Virtuozzo 7.0 Update 5 provides stability bug fixes. Vulnerability id: PSBM-70646 Actual grace period was shorter than the declared 259200 seconds. Vulnerability id: PSBM-73164 Increased yum lock timeout in vz-qemu-engine-updater to provide for future major updates. Vulnerability...

SolarWinds Network Performance Monitor 12.0.15300.90 Cross Site Scripting Vulnerability

Exploit for windows platform in category dos / poc ------------------------------------------------------------- Vulnerability type: Persistent Cross-Site Scripting ------------------------------------------------------------- Credit: Andy Tan CVE ID: CVE-2017-9537...

TrendMicro OfficeScan 11.0 / XG (12.0) XG Image File Execution Bypass

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-OFFICESCAN-XG-IMAGE-FILE-EXECUTION-BYPASS.txt + ISR: ApparitionSec Vendor: ================== www.trendmicro.com Product: ======== OfficeScan v11.0 and XG 12.0...

SolarWinds Network Performance Monitor 12.0.15300.90 Cross Site Scripting

------------------------------------------------------------- Vulnerability type: Persistent Cross-Site Scripting ------------------------------------------------------------- Credit: Andy Tan CVE ID: CVE-2017-9537 ----------------------------------------------- Product: SolarWinds Network...

Product update: Virtuozzo 7.0 Update 5 Hotfix 3 (7.0.5-646)

The Hotfix 3 for Virtuozzo 7.0 Update 5 provides security and stability bug fixes. Vulnerability id: CVE-2017-13672, PSBM-72398 QEMU aka Quick Emulator, when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service out-of-bounds read and QEM...

Citrix XenServer Multiple Vulnerabilities (CTX227185)

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities as noted in the CTX227185 advisory. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid103381; scriptversion"1.7";...

Product update: Virtuozzo 7.0 Update 5 Hotfix 2 (7.0.5-642)

The Hotfix 2 for Virtuozzo 7.0 Update 5 provides stability and usability bug fixes. Vulnerability id: PSBM-70653 Unable to connect network adapter to a running VM. Vulnerability id: PSBM-70557 Ghost file limit was ignored when migrating containers. Vulnerability id: PSBM-70551 plooptrim could ent...

Citrix XenServer Multiple Security Updates (CTX227185)

A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to compromise the host. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

SolarWinds Log and Event Manager < 6.3.1 Hotfix 3 Jailbreak and Privilege Escalation

According to its self-reported version number, the SolarWinds Log and Event Manager installed on the remote host is prior to version 6.3.1 Hotfix 3. It is, therefore, affected by multiple vulnerabilities : - Due to the program setting insecure permissions for management scripts, a remote attacker...

Product update: Virtuozzo 7.0 Update 5 Hotfix 1 (7.0.5-631)

The Hotfix 1 for Virtuozzo 7.0 Update 5 provides a new feature as well as stability and usability bug fixes. Vulnerability id: PSBM-70449 Copying small service files stored on MDS could result in cluster unmount. Vulnerability id: PSBM-69911 VNC console in PowerPanel did not work for VMs running ...

Path traversal

A Path Traversal CWE-22 vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is...

CVE-2017-7423

A Cross-Site Request Forgery CWE-352 vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes...

CVE-2017-7423

The CVE-2017-7423 issue affects Micro Focus Enterprise Developer and Enterprise Server (2.3, including 2.3 Update 1 before Hotfix 8 and 2.3 Update 2 before Hotfix 9) where the esfadmingui component is vulnerable to Cross-Site Request Forgery (CSRF, CWE-352). An unauthenticated remote attacker can...

Citrix XenServer Multiple Vulnerabilities (CTX225941)

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities as noted in the CTX225941 advisory. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid102526; scriptversion"1.11";...

Solarwinds LEM 6.3.1 Hardcoded Credentials Vulnerability

Exploit for linux platform in category local exploits Title: Solarwinds LEM Hardcoded Credentials Advisory ID: KL-001-2017-015 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-015.txt 1. Vulnerability Details Affected Vendor: Solarwinds...

Solarwinds LEM 6.3.1 Hardcoded Credentials

KL-001-2017-015 : Solarwinds LEM Hardcoded Credentials Title: Solarwinds LEM Hardcoded Credentials Advisory ID: KL-001-2017-015 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-015.txt 1. Vulnerability Details Affected Vendor: Solarwinds...