7482 matches found
Four New Normals for 2017
Let’s not talk about cybersecurity predictions for 2017. Let’s talk instead about new normals, things that have ceased to be novel because, well, they happen all the time and everywhere. Let’s concede that things such as greedy ransomware, imposing IOT botnets, high-profile bug bounties and...
Fedora 25 : botan (2016-3b59109c48)
Botan 1.10.14 - NOTE WELL: Botan 1.10.x is supported for security patches only until 2017-12-31 - Fix integer overflow during BER decoding, found by Falko Strenzke. This bug is not thought to be directly exploitable but upgrading ASAP is advised. CVE-2016-9132 - Fix two cases where in error...
Fedora 24 : botan (2016-7de64a450f)
Botan 1.10.14 - NOTE WELL: Botan 1.10.x is supported for security patches only until 2017-12-31 - Fix integer overflow during BER decoding, found by Falko Strenzke. This bug is not thought to be directly exploitable but upgrading ASAP is advised. CVE-2016-9132 - Fix two cases where in error...
CVE-2016-6659
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release aka uaa-release before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially craft...
Code injection
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release aka uaa-release before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially craft...
CVE-2016-6659
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release aka uaa-release before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially craft...
CVE-2016-6659
CVE-2016-6659 affects Cloud Foundry components: Cloud Foundry release v247 and earlier, UAA 2.x up to 2.7.4.12, UAA 3.x up to 3.6.5, and 3.7.x–3.9.x up to 3.9.3, plus the UAA bosh release (uaa-release) up to v13.9 (for 3.6.5) or v24 (for 3.9.3). The root cause is an elevation of privilege through...
CVE-2016-6659
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release aka uaa-release before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially craft...
CVE-2016-7270
The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information by leveraging key guessability, aka ".NET Information Disclosure...
Information disclosure
The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information by leveraging key guessability, aka ".NET Information Disclosure...
CVE-2016-7270
CVE-2016-7270 affects the Data Provider for SQL Server in Microsoft .NET Framework 4.6.2. The vulnerability arises from mishandling a developer-supplied key, allowing remote attackers to bypass Always Encrypted and obtain sensitive cleartext data. Impact is information disclosure due to key guess...
CVE-2016-7270
The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information by leveraging key guessability, aka ".NET Information Disclosure...
CVE-2016-9592
A flaw was found where a volume fails to detach, which causes the delete operation to fail with 'VolumeInUse' error. Since the delete operation is retried every 30 seconds for each volume, this could lead to a denial of service attack as the number of API requests being sent to the cloud-provider...
Privilege Escalation
UAA is vulnerable to privilege escalation. A malicious user can gain access to the UAA logs and run a specially crafted application that interacts with the SAML provider...
Remote Code Execution (RCE)
RESTEasy is vulnerable to remote code execution. SnakeYAML unmarshalling is exploitable for code execution. As RESTeasy uses SnakeYAML and enables the yaml provider by default, under certain conditions, RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of...
CVE-2016-6659: UAA Privilege Escalation | Cloud Foundry
Critical Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v247 and earlier versions UAA release v3.9.2 & earlier versions UAA bosh release uaa-release v23 & earlier versions Description This security update resolves vulnerabilities in UAA. The most severe of the...
Microsoft .NET Framework Information Disclosure Vulnerability (CNVD-2016-12419)
Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation USA and a development platform for building Windows, Windows Store, Windows Phone, Windows Server and Microsoft Azure Windows Store, Windows Phone, Windows Server, and Microsoft Azure...
NetApp hardware VSS provider limitation
Challenge Hyper-V Backup/Replication Job utilizing NetApp Data ONTAP VSS Hardware Provider reports warning or error message: "Another shadow copy creation is already in progress. Please wait a few moments and try again" Cause NetApp hardware VSS provider doesn't allow concurrent snapshot creation...
Unspecified Vulnerability in IBM IMS Enterprise Suite Data Provider for Microsoft .NET
IBM IMS Enterprise Suite Data Provider for Microsoft .NET is a solution from IBM USA that provides Microsoft .NET based applications to access and manipulate IMS data. The solution supports access to IMS data from .NET applications using standard SQL queries and handling of IMS connected links an...