Cisco TelePresence Video Communication Server Expressway Unauthorized Access Vulnerability

Cisco TelePresence Video Communication Server is a telepresence video communication server from Cisco. Cisco TelePresence Video Communication Server VCS Expressway X8.6 has a security vulnerability in its implementation, which can be exploited by an authenticated remote user to bypass the target...

CVE-2015-6413

Cisco TelePresence VCS Expressway X8.6 contains a web‑framework access control flaw that allows remote authenticated users to bypass read‑only restrictions and upload Tandberg Linux Package (TLP) files by visiting an administrative page (CVE-2015-6413). Root cause: missing authorization checks on...

CVE-2015-6413: Undefined Security Weakness

Cisco TelePresence Video Communication Server VCS Expressway X8.6 allows remote authenticated users to bypass intended read-only restrictions and upload Tandberg Linux Package TLP files by visiting an administrative page, aka Bug ID CSCuw55651...

pacemaker: acl read-only access allow role assignment

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well...

Moderate: Red Hat Security Advisory: binutils security, bug fix, and enhancement update

Updated binutils packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

FreeBSD : xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen (301b04d7-881c-11e5-ab94-002590263bf5)

"The Xen Project reports : Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen the upstream-based qemu %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

CVE-2013-1957

The clonemnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNTREADONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace...

Xen Elevation of Privilege Vulnerability

Xen is a virtualization technology used in the Linux kernel that allows multiple operating systems to run simultaneously. An elevation of privilege vulnerability exists in Xen 4.1.x through 4.6.x that allows a local user to write a read-only disk image...

CVE-2015-7311

libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image...

UBUNTU-CVE-2015-7311

libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image...

CVE-2015-7311: Undefined Security Weakness

libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image...

CVE-2015-6464

The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin...

CVE-2015-6464

The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin...

CVE-2015-6464

CVE-2015-6464 affects Moxa EDS-405A/EDS-408A switches. The administrative web interface contains an improper privilege management flaw that lets remote authenticated users bypass the read-only protection via a Firefox web developer plugin. Impact: elevation of privileges (read/write where only re...

CVE-2015-6464: Undefined Security Weakness

The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin...

Input validation

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

CVE-2015-4328

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

Cisco TelePresence Video Communication Server Expressway Arbitrary Command Execution Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

CVE-2015-1867: Undefined Security Weakness

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command...

pacemaker: acl read-only access allow role assignment

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well...