Design/Logic Flaw

The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets...

CVE-2017-13694

The acpipscompletefinalop function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and nodeext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism ...

Design/Logic Flaw

The acpidscreateoperands function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism in the kerne...

Directory traversal

UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file...

CVE-2017-9498

The Comcast firmware on Motorola MX011ANM firmware version MX011AN2.9p6s1PRODsey and Xfinity XR11-20 Voice Remote devices allows local users to upload arbitrary firmware images to an XR11 by leveraging root access. In other words, there is no protection mechanism involving digital signatures for...

CVE-2017-11465

The parseryyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service invalid write or read or possibly have unspecified other impact via a crafted Ruby script, related to the parsertokaddutf8 function in parse.y. NOTE: this might have security relevance as a...

CVE-2017-11472

The acpinsterminate function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism in the kernel throug...

CVE-2017-11472

CVE-2017-11472 affects the Linux kernel via the acpi_ns_terminate() path in drivers/acpi/acpica/nsutils.c. The flaw does not flush the operand cache, enabling a local user to dump kernel memory and bypass KASLR by crafting an ACPI table, with impact described for kernels before 4.12 (and through ...

CVE-2017-11465

The parseryyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service invalid write or read or possibly have unspecified other impact via a crafted Ruby script, related to the parsertokaddutf8 function in parse.y. NOTE: this might have security relevance as a...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3312-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3312-1 advisory. It was discovered that the netfilter netlink implementation in the Linux kernel did not properly validate batch messages. A local attacker with the...

Type confusion

Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initializedscparser...

Ipswitch MOVEit Transfer Security Bypass Vulnerability

Ipswitch MOVEit Transfer formerly DMZ an automated file transfer system from Ipswitch USA. The system supports the control, management, and viewing of all business-critical file transfer activities through a single, secure system. A security bypass vulnerability exists in Ipswitch MOVEit Transfer...

EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1001)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the BP and OF exceptions, which allows guest OS users to cause a denial of service...

EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1056)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol DCCP implementation freed SKB socket buffer...

Directory traversal

dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source...

Sql injection

OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leveraging the availability of the dmbptransition docbase method with a user-created dmprocedure object,...

Schneider Electric Modicon M221 PLCs and SoMachine Basic

CVSS v3 10.0 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: Schneider Electric Equipment: Modicon M221 PLCs and SoMachine Basic Vulnerability: Use of Hard-Coded Cryptographic Key, Protection Mechanism Failure AFFECTED PRODUCTS Schneider Electric...

Schneider Electric Modicon M221 PLCs and SoMachine Basic (Update A)

CVSS v3 10.0 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: Schneider Electric Equipment: Modicon M221 PLCs and SoMachine Basic Vulnerability: Use of Hard-Coded Cryptographic Key, Protection Mechanism Failure UPDATE INFORMATION This updated...

CVE-2017-7305

Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism via a crafted boot. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contain...

AVG Antivirus Code Injection Vulnerability

AVG Antivirus is prone to a code injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:avg:anti-virus";...