Apple Mac OS X Security Updates (HT208331)-03

Apple Mac OS X is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WebKitGTK+ Code Execution / Cookie Handling / Memory Corruption Vulnerabilities

WebKitGTK+ has had numerous security vulnerabilities addressed including arbitrary code execution, memory corruption, cookie theft, and various other issues. ------------------------------------------------------------------------ WebKitGTK+ Security Advisory...

Move WEM SQL database to a new SQL instance with/without SysAdmin permissions

Unable to perform a migration of the WEM Database to a new SQL Server due to minimal permissions in SQL. SysAdmin permissions on new SQL Server are not allowed and thus can not be used from the WEM broker...

Apple iCloud Security Updates (HT208142)

Apple iCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:icloud"; ifdescription...

PT-2017-18385 · Microsoft · Sql Server Analysis Services +1

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server Analysis Services versions 2012 through 2016 Description: An information disclosure issue exists due to improper permission enforcement. If an attacker's credentials allow access to an affected SQL server database, they...

UBUNTU-CVE-2017-9232

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root...

CVE-2016-10120

Firejail uses 0777 permissions when mounting 1 /dev, 2 /dev/shm, 3 /var/tmp, or 4 /var/lock, which allows local users to gain privileges...

CVE-2017-0884

CVE-2017-0884 affects Nextcloud Server prior to versions 9.0.55 and 10.0.2 . A logical error in the file caching layer allows an authenticated attacker who has at least read-only permissions to create empty folders inside a shared folder, i.e., a creation of folders in read-only folders despite l...

CVE-2016-9461

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to...

NVIDIA GPU and GeForce Experience Elevation of Privilege Vulnerability

The NVIDIA GPU and GeForce Experience installer is a set of installation tools from NVIDIA that are used to automatically update the graphics card drivers in the GPU graphics processor. A security vulnerability exists in NVIDIA GPU and GeForce Experience installer, which arises from the program...

CVE-2017-0398

An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1,...

CVE-2016-9837

An issue was discovered in templates/beez3/html/comcontent/article/default.php in Joomla! before 3.6.5. Inadequate permissions checks in the Beez3 layout override of the comcontent article view allow users to view articles that should not be publicly accessible, as demonstrated by an...

ZendStudio IDE Privilege Vulnerability

Zend Studio is Zend Technologies developed PHP language integrated development environment Integrated Development Environment IDE, which combines PHP and mobile development , and includes some simple mobile application source code. An elevation of privilege vulnerability exists in ZendStudio IDE...

Apple iTunes Multiple Vulnerabilities (Sep 2016) - Windows

Apple iTunes is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:itunes"; ifdescription...

About the security content of OS X El Capitan v10.11.6 and Security Update 2016-004

About the security content of OS X El Capitan v10.11.6 and Security Update 2016-004 This document describes the security content of OS X El Capitan v10.11.6 and Security Update 2016-004. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm securi...

Cybozu Garoon fails to restrict access permissions

Overview Cybozu Garoon is a groupware. Cybozu Garoon fails to restrict access permissions in the API to retrieve the Address Book information. Note that this vulnerability is different from JVN53542912. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through...

MGASA-2016-0177 Updated xymon packages fix security vulnerabilities

Updated xymon packages fix security vulnerabilities: The incorrect handling of user-supplied input in the "config" command can trigger a stack-based buffer overflow, resulting in denial of service via application crash or remote code execution CVE-2016-2054. The incorrect handling of user-supplie...

SUSE-SU-2016:1346-1 Security update for systemd

This update for SystemD provides fixes and enhancements. The following security issue has been fixed: - Don't allow read access to journal files to users. bsc972612, CVE-2014-9770, CVE-2015-8842 The following non-security issues have been fixed: - Restore initrd-udevadm-cleanup-db.service...

abrt: incorrect permissions on /var/spool/abrt

It was discovered that the kernel-invoked coredump processor provided by ABRT did not handle symbolic links correctly when writing core dumps of ABRT programs to the ABRT dump directory /var/spool/abrt. A local attacker with write access to an ABRT problem directory could use this flaw to escalat...

PYSEC-2015-41

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider SP owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name...