ALPINE-CVE-2020-29482

An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily usi...

CVE-2020-29482

An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily usi...

UBUNTU-CVE-2020-29482

An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily usi...

CVE-2020-29482

CVE-2020-29482 affects Xen up to 4.14.x via oxenstored. A guest can create xenstore paths in its own namespace that exceed the pathname limit, because management tools must use absolute paths and oxenstored enforces a limit on the client-specified path. This can cause some management tools and de...

CVE-2020-29482

An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily usi...

CVE-2020-29482

An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily usi...

Xenstore: wrong path length check

ISSUE DESCRIPTION A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily using absolute paths. oxenstored...

Xen Code Issues Vulnerabilities

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen versi...

The vulnerability of the Intel SSD Data Center Tool’s management and update tools, related to errors in using standard permissions, allows attackers to escalate their privileges.

The vulnerability of the Intel SSD Data Center Tool, a tool for managing and updating embedded software, is related to errors in the use of standard permissions. Exploiting this vulnerability can allow attackers to increase their privileges...

Microsoft Exchange Servers Still Open to Actively Exploited Flaw

Over half of exposed Exchange servers are still vulnerable to a severe bug that allows authenticated attackers to execute code remotely with system privileges – even eight months after Microsoft issued a fix. The vulnerability in question CVE-2020-0688 exists in the control panel of Exchange,...

[SECURITY] Fedora 31 Update: squid-4.11-1.fc31

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...

pikachu

This is an offensive tool for Web application security testing. It is a web application that contains various web security vulnerabilities, including Burt Force brute-force, XSS cross-site scripting, CSRF cross-site request forgery, SQL-Inject SQL injection, RCE remote code execution, Files...

[SECURITY] Fedora 30 Update: xen-4.11.3-3.fc30

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

The vulnerability of the application management tools and Flatpak environments, related to errors in processing file descriptors, allows a hacker to modify any executable files on the host side.

The vulnerability of the application management tool and the Flatpak environment is related to errors in processing file descriptors. Exploiting this vulnerability allows an attacker to modify arbitrary executable files on the host by executing the “applyextra” script...

CVE-2019-19882

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing...

Drupal Booking and Availability Management Tools Module Access Bypass Vulnerability

Description The Booking and Availability Management Tools BAT module for Drupal is prone to an access-bypass vulnerability. Attackers can leverage this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. Booking and Availability...

The vulnerability affects the web interface for controlling the Cisco Integrated Management Controller (IMC) Supervisor, as well as tools for managing physical infrastructure and virtual environments like Cisco UCS Director and Cisco UCS Director Express for Big Data. This allows attackers to gain access to target systems with administrator privileges.

The vulnerability of the Cisco Integrated Management Controller IMC Supervisor web interface, as well as the tools for managing physical infrastructure and virtual environments like Cisco UCS Director and Cisco UCS Director Express for Big Data, is related to authentication procedures that have...

[SECURITY] Fedora 29 Update: squid-4.8-2.fc29

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...

The vulnerability of the secomp component of the application management tools and Flatpak environments allows a attacker to elevate their privileges and execute arbitrary code.

The vulnerability of the secomp component in application management tools and Flatpak environments is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to increase their privileges and execute arbitrary code...

Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability

A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters...