glusterfs: Improper resolution of symlinks allows for privilege escalation

A flaw was found in RPC request using gfs3symlinkreq in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on...

glusterfs: Heap-based buffer overflow via "gf_getspec_req" RPC message

A buffer overflow on the heap was found in gfgetspecreq RPC request. A remote, authenticated attacker could use this flaw to cause denial of service and read arbitrary files on glusterfs server node...

samba: NULL pointer dereference in printer server process

A null pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash...

VulnCheck KEV: CVE-2018-9866

A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System GMS virtual appliance's, allow remote user to execute arbitrary code. This vulnerability affected GMS version 8.1 and earlier...

Oracle Sun Systems Products Suite Solaris Has Denial of Service Vulnerability

Oracle Sun Systems Products Suite is a suite of Sun systems products from Oracle Corporation, of which Solaris is one of the computer operating system components. A security vulnerability exists in the RPC subcomponent of the Solaris component of the Oracle Sun Systems Products Suite, versions 10...

CVE-2018-18075

WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...

OpenAFS has an unspecified vulnerability (CNVD-2019-43380)

OpenAFS is a distributed file system that allows sharing of archives and resources between systems over LANs and WANs. A security vulnerability exists in OpenAFS versions prior to 1.6.23 and 1.8.x prior to 1.8.2, which stems from an RPC server routine that does not sufficiently initialize an outp...

OpenAFS has an unspecified vulnerability

OpenAFS is a distributed file system that allows sharing of archives and resources between systems over LANs and WANs. A security vulnerability exists in OpenAFS versions prior to 1.6.23 and 1.8.x prior to 1.8.2, which stems from the backup tape controller process not requiring authentication for...

UBUNTU-CVE-2018-16948

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSC...

DEBIAN-CVE-2018-16949

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values...

Primary Stuxnet Advisory

OVERVIEW ICS-CERT has been actively investigating and reporting on the Stuxnet vulnerability. To date, ICS-CERT has released ICSA-10-201-01 - Malware Targeting Siemens Control Software including Updates B & C and ICSA-10-238-01 - Stuxnet Mitigations including Update B. Stuxnet uses four zero-day...

Red Hat glusterfs server RPC request processor component arbitrary file creation vulnerability

Red Hat glusterfs server is an open source distributed file system from Red Hat Red Hat. The system is mainly for media streaming , data analysis and other data and bandwidth intensive tasks to create large-scale distributed storage solutions. A security vulnerability exists in the 'gfs2createreq...

DEBIAN-CVE-2018-10929

A flaw was found in RPC request using gfs2createreq in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes...

DEBIAN-CVE-2018-10930

A flaw was found in RPC request using gfs3renamereq in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume...

UBUNTU-CVE-2018-10927

A flaw was found in RPC request using gfs3lookupreq in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote denial of service by crashing gluster brick process...

UBUNTU-CVE-2018-10928

A flaw was found in RPC request using gfs3symlinkreq in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on...

UBUNTU-CVE-2018-10926

A flaw was found in RPC request using gfs3mknodreq supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node...

Libtirpc infinite loop vulnerability

libtirpc is a package containing support for using the Remote Procedure Call RPC API. An infinite loop vulnerability exists in versions prior to libtirpc 1.0.2-rc2. An attacker could exploit this vulnerability to cause a denial of service file descriptor exhaustion...

Cobbler Cross-Site Scripting Vulnerability

Cobbler is a network installation server suite that makes it possible to quickly set up a Linux network installation environment. A cross-site scripting vulnerability exists in cobbler-web in Cobbler 2.0.0+ and prior versions. A remote attacker can exploit this vulnerability by sending an...

CVE-2018-1000226

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...