CVE-2018-1000622

The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the...

[SECURITY] Fedora 27 Update: redis-4.0.10-1.fc27

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Memory Read Out-of-Bounds Vulnerability in Inventec VS Series HMI Programming Software

Shenzhen Inventec Electric Co., Ltd. is a product and service provider in the field of electrical transmission, industrial control and new energy. A memory read out-of-bounds vulnerability exists in Inventec's VS series HMI programming software. The vulnerability is caused due to a file failure t...

Detecting Kernel Memory Disclosure – Whitepaper

Posted by Mateusz Jurczyk, Project Zero Since early 2017, we have been working on Bochspwn Reloaded – a piece of dynamic binary instrumentation built on top of the Bochs IA-32 software emulator, designed to identify memory disclosure vulnerabilities in operating system kernels. Over the course of...

Oracle Linux 7 : plexus-archiver (ELSA-2018-1836)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1836 advisory. 0:2.4.2-5 - Fix arbitrary file write vulnerability - Resolves: CVE-2018-1002200 Tenable has extracted the preceding description block directly from the Oracle...

Important: Red Hat Security Advisory: rh-maven33-plexus-archiver and rh-maven35-plexus-archiver security update

An update for rh-maven33-plexus-archiver and rh-maven35-plexus-archiver is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

[SECURITY] Fedora 27 Update: ruby-2.4.4-89.fc27

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1510-1)

This update for the Linux Kernel 4.4.103-9256 fixes several issues. The following security issues were fixed : - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver was fixed. bsc1085447. - CVE-2018-8897: A statement in the System Programming Guide of the Intel...

'Zip Slip' Vulnerability Affects Thousands of Projects Across Many Ecosystems

Security researchers at British software firm Snyk have revealed details of a critical vulnerability that affects thousands of projects across many ecosystems and can be exploited by attackers to achieve code execution on the target systems. Dubbed "Zip Slip ," the issue is an arbitrary file...

SUSE-SU-2018:1516-1 Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP2)

This update for the Linux Kernel 4.4.90-9250 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver was fixed. bsc1085447. - CVE-2018-8897: A statement in the System Programming Guide of the Intel 6...

[SECURITY] Fedora 26 Update: ruby-2.4.4-88.fc26

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

Dataiku DSS Information Disclosure Vulnerability

Dataiku DSS is a data processing collaboration platform. the REST API is one of the APIs that supports lightweight REST style web scripts. A security vulnerability exists in the REST API in Dataiku DSS versions prior to 4.2.3. A remote attacker could exploit the vulnerability to obtain sensitive...

EulerOS 2.0 SP1 : libvncserver (EulerOS-SA-2018-1139)

According to the version of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - LibVNCServer makes writing a VNC server or more correctly, a program exporting a framebuffer via the Remote Frame Buffer protocol easy.It hide...

OWASP Joomla Vulnerability Scanner Project: JoomScan

OWASP JoomScan short for Joomla Vulnerability Scanner is an opensource project in perl programming language to detect Joomla CMS vulnerabilities and analysis. If you want to do a penetration test on a Joomla CMS, OWASP JoomScan is Your best shot ever! This Project is being faster than ever and...

The vulnerability of the Qualcomm Qurt API component of the Android operating system allows a hacker to trigger buffer overflows.

The vulnerability of the Qualcomm Qurt API in the Android operating system is caused by a numerical overflow. Exploiting this vulnerability can allow a malicious actor to trigger a buffer overflow...

CVE-2018-7248

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

Medium: golang

Issue Overview: Arbitrary code execution during go get or go get -d Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points t...

[SECURITY] Fedora 28 Update: perl-5.26.2-410.fc28

Perl is a high-level programming language with roots in C, sed, awk and she ll scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4098)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-4098 advisory. kernel-uek 3.8.13-118.20.7 - x86/entry/64: Dont use IST entry for BP stack Andy Lutomirski CVE-2018-8897 Tenable has extracted the preceding description blo...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2018-4097)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-4097 advisory. 2.6.39-400.298.7 - net/rds: Fix endless RNR situation Hakon Bugge Orabug: 27645402 - x86/entry/64: Dont use IST entry for BP stack Andy Lutomirski...