Mozilla: Sandbox escape allowing file system read access through file picker (MFSA 2017-12)

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...

Mozilla: Sandbox escape allowing local file system read access (MFSA 2017-12)

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR 52.1 and Firefox 53...

openSUSE Security Update : gstreamer-plugins-good (openSUSE-2017-495)

This update for gstreamer-plugins-good fixes the following issues : - A crafted aac audio file could have caused an invalid read and thus corruption or denial of service bsc1024014, CVE-2016-10198 - A crafted mp4 file could have caused an invalid read and thus corruption or denial of service...

UBUNTU-CVE-2017-5454

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...

Qemu: display: cirrus: OOB read access issue

An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions for example, cirrusbitbltropfwdtransp. A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in...

SUSE-SU-2017:1010-1 Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues: - A crafted aac audio file could have caused an invalid read and thus corruption or denial of service bsc1024014, CVE-2016-10198 - A crafted mp4 file could have caused an invalid read and thus corruption or denial of service...

The vulnerability of the software for Cisco WebEx Meetings Server allows a hacker to gain read-only access to certain information stored in the system.

The vulnerability of the XML External Entity component of the Cisco WebEx Meetings Server software relates to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to gain read access to certain information stored in the system...

CVE-2017-3811

An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc39165. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.2054...

Xxe

An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc39165. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.2054...

CVE-2017-3811

CVE-2017-3811 affects Cisco WebEx Meetings Server (CWMS). It is an XML External Entity (XXE) information-disclosure vulnerability where an authenticated, remote attacker can read part of the information stored on the affected system. The underlying issue occurs during XML parsing. Affected releas...

RedHat Update for qemu-kvm RHSA-2017:0309-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenJDK: integer overflow in SocketOutputStream boundary check (Networking, 8164147)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

Important: Red Hat Security Advisory: qemu-kvm security and bug fix update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Adobe Campaign Security Bypass Vulnerability

Adobe Campaign is a set of marketing management solutions from the American company Audobee Adobe. A security bypass vulnerability exists in Adobe Campaign. An attacker could exploit the vulnerability to upload and execute a malicious file, resulting in read and write operations to the affected...

CVE-2016-8341

An issue was discovered in Ecava IntegraXor Version 5.0.413.0. The Ecava IntegraXor web server has parameters that are vulnerable to SQL injection. If the queries are not sanitized, the host's database could be subject to read, write, and delete commands...

OpenJDK: URLClassLoader insufficient access control checks (Networking, 8151934)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: URLClassLoader insufficient access control checks (Networking, 8151934)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

The vulnerability of the Oracle Database database management system allows a hacker to gain read access to data.

The vulnerability of the security component of the Oracle Database, a relational database management system, is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating locally, to gain access to read the data...

The vulnerability of the Oracle VM VirtualBox virtual machine allows a hacker to gain access to data reading, modify data, or cause a partial service failure.

The vulnerability of the GUI component of the Oracle VM VirtualBox lies in security configuration errors. Exploiting this vulnerability allows a malicious actor to gain read access to data, modify, add, or delete data, or cause partial service failure through HTTP requests...

Vulnerability of the Java Platform software platform, which allows a perpetrator to gain access to data for reading purposes

The vulnerability of the Java Platform software platform’s Deployment component is related to lack of access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain read access to data through network packets...