Cisco Integrated Management Controller Hijacked Session Vulnerability

Cisco Integrated Management Controller IMC is the U.S. Cisco Cisco company a set of tools for the management of the UCS Unified Computing System, which supports HTTP, SSH access, etc., and can be on the server, shutdown and reboot operations. A security vulnerability exists in the session...

CVE-2014-9681

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

SUSE-SU-2017:1044-1 Security update for tiff

This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-10272: LibTIFF 4.0.7 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted TIFF image, related to 'WRITE of size 2048' and...

SUSE-SU-2017:1030-1 Security update for libsndfile

This update for libsndfile fixes the following issues: - CVE-2017-7585,CVE-2017-7741,CVE-2017-7742: Some stack-based buffer overflows via a specially crafted FLAC file were fixed error in the 'flacbuffercopy' function bsc1033054, bsc1033914, bsc1033915...

Huawei P7-L10 MeWidget Information Disclosure Vulnerability

The P7-L10 is a smartphone from the Chinese company Huawei.MeWidget is one of the desktop customization tools. An information disclosure vulnerability exists in the MeWidget plugin in Huawei P7-L10 V100R001C00B136 and earlier versions. The vulnerability can be exploited by an attacker with the he...

CVE-2017-0145

creationtimestamp| type| source ---|---|--- 2017-04-17 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41891 2017-05-15 08:36:10+00:00| seen| MISP/591948ff-adb0-4b15-836a-72dfbce2ab96 2017-05-16 12:25:49+00:00| seen| MISP/5919c895-3268-45eb-9b7b-2a8995ca48b7 2017-05-16...

Schneider Electric Modicon PLC Multiple Authentication Bypass Vulnerability (CNVD-2017-04918)

Modicon PLCs are programmable controller products used in industries such as dams, energy, food and agriculture, and more. A multiple authentication bypass vulnerability exists in the Schneider Electric Modicon PLC, where an attacker accessing the OT network could intercept traffic to the target...

X.Org: Multiple vulnerabilities

Background X.Org X servers Description Multiple vulnerabilities have been discovered in X.Org server and libraries. Please review the CVE identifiers referenced below for details. Impact A local or remote users can utilize the vulnerabilities to attach to the X.Org session as a user and execute...

Multiple Huawei server information leakage vulnerabilities

Huawei Tecal RH1288 V2 and others are servers from Huawei, a Chinese company. An information disclosure vulnerability exists in several Huawei servers. The vulnerability can be exploited by an attacker to view the session IDs of all online users in the Online Users page of the Web UI...

SUSE-SU-2017:0940-1 Security update for audiofile

This audiofile update fixes the following issue: Security issues fixed: - CVE-2015-7747: Fixed buffer overflow issue when changing both number of channels and sample format. bsc949399 - CVE-2017-6827: heap-based buffer overflow in MSADPCM::initializeCoefficients MSADPCM.cpp bsc1026979 -...

Hak5 WiFi Pineapple Pre-Configured Command Injection Vulnerability

Hak5 WiFi Pineapple is a penetration testing tool used in offensive wireless campaigns. A command injection vulnerability exists in the Hak5 WiFi Pineapple preconfiguration, which can be exploited by an attacker to use predictable anti-CSRF tokens based on session IDs...

CVE-2017-2405

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a...

CVE-2016-9125

Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to ste...

PT-2017-9962

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The issue allows arbitrary session identifiers to be forced and does not invalidate the existing session upon successful authentication, potentially enabling an attacker to steal an...

CVE-2016-9125: Session Fixation

Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to ste...

tomcat: information disclosure due to incorrect Processor sharing

A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body...

tomcat: information disclosure due to incorrect Processor sharing

A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body...

CVE-2016-7971

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PYSEC-2017-56

Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors...

GLSA-201702-22 : Mozilla Firefox: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201702-22 Mozilla Firefox: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execut...