April 10, 2018—KB4093118 (Monthly Rollup)

None None...

March 13, 2018—KB4088878 (Security-only update)

None None...

CVE-2017-15044

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by...

Design/Logic Flaw

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by...

CVE-2017-15044

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by...

CVE-2017-15044

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by...

CVE-2017-15044

The CVE-2017-15044 issue concerns DocuWare Fulltext Search server (up to version 6.11). The embedded Solr service is reachable from the network due to the server listening on a network interface (not localhost), allowing remote users to connect, download searchable text, and potentially bypass Do...

NIELD v0.6.1 - Network Interface Events Logging Daemon

NIELD Network Interface Events Logging Daemon is a tool to receive notifications from kernel through netlink socket, and generate logs related to interfaces, neighbor cache ARP,NDP, IP address IPv4,IPv6, routing, FIB rules, traffic control. Download $ git clone https://github.com/t2mune/nield.git...

Amazon Linux AMI : kernel (ALAS-2017-901)

A buffer overflow was discovered in tpacketrcv function in the Linux kernel since v4.6-rc1 through v4.13. A number of socket-related syscalls can be made to set up a configuration when each packet received by a network interface can cause writing up to 10 bytes to a kernel memory outside of a...

Medium: kernel

Issue Overview: A buffer overflow was discovered in tpacketrcv function in the Linux kernel since v4.6-rc1 through v4.13. A number of socket-related syscalls can be made to set up a configuration when each packet received by a network interface can cause writing up to 10 bytes to a kernel memory...

CVE-2017-14497

A buffer overflow was discovered in tpacketrcv function in the Linux kernel since v4.6-rc1 through v4.13. A number of socket-related syscalls can be made to set up a configuration when each packet received by a network interface can cause writing up to 10 bytes to a kernel memory outside of a...

The vulnerability in the Bluetooth stack profile of the Android operating system allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability in the Bluetooth stack of the Android operating system’s Personal Area Networking PAN service is related to incorrect security requirements. Exploiting this vulnerability allows a remote attacker to create a network interface and use it to execute a “man-in-the-middle” attack...

The vulnerability in the implementation of the SDP protocol for Bluetooth driver of Windows operating systems allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the SDP protocol implementation for Bluetooth drivers in Windows operating systems is related to incorrect security requirements. Exploiting this vulnerability allows a malicious actor to create a network interface and use it to execute a type of “man-in-the-middle” attack...

NoviFlow NoviWare and NoviSwitch Device Remote Code Execution Vulnerability

NoviFlow NoviWare and NoviSwitch devices are both products of NoviFlow Canada.NoviSwitch devices are a series of switching devices.NoviWare is the switching software used in... A security vulnerability exists in the network interface of noviprocessmanagerdaemon in NoviFlow NoviWare NW400.2.6 and...

Stack overflow

A network interface of the noviprocessmanagerdaemon service, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be...

CVE-2017-12787

A network interface of the noviprocessmanagerdaemon service, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be...

CVE-2017-12787

The vulnerability CVE-2017-12787 affects NoviFlow/NoviWare NW400.2.6 and NoviSwitch devices, where the network interface of the novi_process_manager_daemon can be inadvertently exposed during ACL modifications. The bug can allow remote, unauthenticated attackers to execute code with root privileg...

Highly Customizable Raspberry Pi USB Attack Platform: P4wnP1

P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W required for HID backdoor. Introduction the Windows LockPicker unlock Windows boxes with weak passwords, fully automated by attaching P4wnP1 the HID covert channel backdoor Get remote...

Cisco DPC3939 Firmware Information Disclosure Vulnerability

Cisco DPC3939 is a wireless voice gateway product from Cisco USA. A security vulnerability exists in the Cisco DPC3939 firmware. Allows an attacker to communicate with the internal network interface of the Network Processor Atom Linux instance...

UBUNTU-CVE-2017-7458

The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an empty field that should have contained a hostname or IP address...