Amazon Linux AMI : git (ALAS-2017-842)

Escape out of git-shell A flaw was found in the way git-shell handled command-line options for the restricted set of git-shell commands. A remote authenticated attacker could use this flaw to bypass git-shell restrictions, to view and manipulate files, by abusing the instance of the less command...

samba: Flaws in Kerberos PAC validation can trigger privilege elevation

A flaw was found in the way Samba handled PAC Privilege Attribute Certificate checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process...

business-central: Multiple stored XSS in task and process filters

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly...

CVE-2017-7219

A heap overflow vulnerability in Citrix NetScaler Gateway versions 10.1 before 135.8/135.12, 10.5 before 65.11, 11.0 before 70.12, and 11.1 before 52.13 allows a remote authenticated attacker to run arbitrary commands via unspecified vectors...

CVE-2017-7219

CVE-2017-7219 is a heap overflow in Citrix NetScaler Gateway that allows a remote authenticated attacker to execute arbitrary commands. Affected products are Citrix NetScaler Gateway versions: 10.1 before 135.8/135.12, 10.5 before 65.11, 11.0 before 70.12, and 11.1 before 52.13. The vulnerability...

CVE-2017-2635

A NULL pointer deference flaw was found in the way libvirt handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service...

CVE-2016-9208

A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder could allow an authenticated, remote attacker to access files in arbitrary locations on the file system of an affected device. More Information: CSCva98951...

Workbench: Path traversal vulnerability

Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host...

GroundWork monarch_scan.cgi OS Command Injection (CVE-2013-3502)

A vulnerability exists in GroundWork 6.7.0. The vulnerability exists in the monarchscan.cgi where user controlled input is used in a perl function. This allows any remote authenticated attacker, regardless of privileges, to inject system commands and gain arbitrary code execution...

postgresql: CASE/WHEN with inlining can cause untrusted pointer dereference

A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code...

postgresql: CASE/WHEN with inlining can cause untrusted pointer dereference

A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code...

AIX 6.1 TL 9 : bind (IV81279) (deprecated)

ISC BIND is vulnerable to a denial of service, caused by improper bounds checking in apl42.c. By sending specially crafted Address Prefix List APL data, a remote authenticated attacker could exploit this vulnerability to trigger an INSIST assertion failure and cause the named process to terminate...

AIX 7.2 TL 0 : bind (IV81282) (deprecated)

ISC BIND is vulnerable to a denial of service, caused by improper bounds checking in apl42.c. By sending specially crafted Address Prefix List APL data, a remote authenticated attacker could exploit this vulnerability to trigger an INSIST assertion failure and cause the named process to terminate...

Updated ntp package fixes security vulnerabilities

Yves Younan discovered that NTP incorrectly handled logfile and keyfile directives. In a non-default configuration, a remote authenticated attacker could possibly use this issue to cause NTP to enter a loop, resulting in a denial of service CVE-2015-7850. Yves Younan discovered that NTP incorrect...

The vulnerability of the MySQL database management system allows a remote attacker to cause a service failure.

The vulnerability of the MySQL database management system allows a malicious actor, who operates remotely and has completed the authentication process, to affect the accessibility of data by using the Optimizer subcomponent...

The vulnerability of the MySQL database management system allows a remote attacker to cause a service failure.

The vulnerability in the MySQL database management system allows a malicious actor, who operates remotely and has completed the authentication process, to compromise data accessibility by using the InnoDB subcomponent: DML...

The vulnerability of the MySQL database management system allows a remote attacker to cause a service failure.

The vulnerability of the MySQL database management system may allow a malicious actor, who operates remotely and has completed the authentication process, to compromise the accessibility of data...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the compat-openldap-2.3.432.2.29 package for the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely by a malicious individual who has complete...

Cisco Nexus 9000 Series Denial of Service Vulnerability

Cisco Nexus 9000 switches provide the foundation for an application-centric infrastructure that delivers outstanding scalability, performance, and energy efficiency. A security vulnerability exists in the SNMP subsystem of the Cisco Nexus 9000, which can be exploited by a remote, authenticated...

krb5: buffer overrun in kadmind with LDAP backend (MITKRB5-SA-2014-001)

A buffer overflow was found in the KADM5 administration server kadmind when it was used with an LDAP back end for the KDC database. A remote, authenticated attacker could potentially use this flaw to execute arbitrary code on the system running kadmind...