VMSA-2010-0020 : VMware ESXi 4.1 Update Installer SFCB Authentication Flaw

a. ESXi 4.1 Update Installer SFCB Authentication Flaw Under certain conditions, the ESXi 4.1 installer that upgrades an ESXi 3.5 or ESXi 4.0 host to ESXi 4.1 incorrectly handles the SFCB authentication mode. The result is that SFCB authentication could allow login with any username and password...

CVE-2009-5147

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names...

http-vuln-cve2017-5638 NSE Script

Detects whether the specified URL is vulnerable to the Apache Struts Remote Code Execution Vulnerability CVE-2017-5638. Script Arguments http-vuln-cve2017-5638.path The URL path to request. The default path is "/". http-vuln-cve2017-5638.method The HTTP method for the request. The default method ...

VMSA-2017-0003:VMware Workstation update addresses multiple security issues

VMSA-2017-0003 VMware Workstation update addresses multiple security issues VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2017-0003 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware Workstation update addresses multiple security issues...

Medium: exim

Issue Overview: It was found that Exim leaked DKIM signing private keys to the "mainlog" log file. As a result, an attacker with access to system log files could potentially access these leaked DKIM private keys. Affected Packages: exim Issue Correction: Run yum update exim or yum update --adviso...

FreeBSD : ikiwiki -- multiple vulnerabilities (5ed094a0-0150-11e7-ae1b-002590263bf5)

Mitre reports : ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page...

Low: krb5

Issue Overview: A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a null pointer and crash by supplying an empty DB argument to the modifyprincipal...

Low: glibc

Issue Overview: A stack overflow vulnerability was found in nssdnsgetnetbynamer. On systems with nsswitch configured to include "networks: dns" with a privileged or network-facing service that would attempt to resolve user-provided network names, an attacker could provide an excessively long...

Medium: mysql56

Issue Overview: The following security-related issues were fixed: CVE-2016-8318 Server: Security: Encryption unspecified vulnerability CVE-2016-8327 Server: Replication unspecified vulnerability CVE-2017-3238 Server: Optimizer unspecified vulnerability CVE-2017-3244 Server: DML unspecified...

Medium: mysql55

Issue Overview: The following security-related issues were fixed: CVE-2017-3238 Server: Optimizer unspecified vulnerability CVE-2017-3243 Server: Charsets unspecified vulnerability CVE-2017-3244 Server: DML unspecified vulnerability CVE-2017-3258 Server: DDL unspecified vulnerability CVE-2017-331...

Medium: ghostscript

Issue Overview: It was found that the ghostscript functions getenv, filenameforall and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list...

Medium: ntp

Issue Overview: The following security-related issues were resolved: CVE-2016-7426: Client rate limiting and server responses CVE-2016-7429: Attack on interface selection CVE-2016-7433: Broken initial sync calculations regression CVE-2016-9310: Mode 6 unauthenticated trap information disclosure a...

FreeBSD : vim -- arbitrary command execution (c11629d3-c8ad-11e6-ae1b-002590263bf5)

Mitre reports : vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Important: vim

Issue Overview: A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim. modelines are disabled by default for root, and...

FreeBSD : atheme-services -- multiple vulnerabilities (e47ab5db-c333-11e6-ae1b-002590263bf5)

Mitre reports : modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the 1 LIST, 2 CLEAR, or 3 MODIFY keyword nicks. Buffer overflow in the xmlrpccharencode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme...

Important: tomcat8

Issue Overview: CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener Affected Packages: tomcat8 Issue Correction: Run yum update tomcat8 or yum update...

Medium: 389-ds-base

Issue Overview: CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many...

Important: tomcat6

Issue Overview: CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener Affected Packages: tomcat6 Issue Correction: Run yum update tomcat6 or yum update...

Important: tomcat7

Issue Overview: CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener Affected Packages: tomcat7 Issue Correction: Run yum update tomcat7 or yum update...

Medium: expat

Issue Overview: CVE-2016-0718: Out-of-bounds read flaw An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly,...