10350 matches found
HPESBHF03757 rev.1 - HPE Network Products including Comware 5 and Comware 7 running NTP, Remote Denial of Service (DoS)
Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Comware v7 CW7 Products All versions - Please refer to the RESOLUTION below for a list of updated products. Comware v5 CW5 Products All versions - Please refer to the RESOLUTIO...
Git: Security bypass
Background Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Description Timo Schmid discovered that the Git restricted shell incorrectly filtered allowed commands. Impact A remote attacker...
DEBIAN-CVE-2014-0225
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack...
Citrix ADC: DNS resolution fails towards Name servers.
Citrix ADC is unable to resolve DNS. Effective state of the Name server could bedown...
How to troubleshoot error " Access to company network not available" while enrolling to xenmobile ?
Symptoms : After putting XMS FQDN if we receive error "Access to company network not available " , click on Report and collect logs LOG ANALYSIS : Below error message indicates that user is entering incorrect FQDN or the DNS is unable to resolve the FQDN. HTTPClientCertCredID=null,...
Qemu: VNC: memory corruption due to unchecked resolution limit
An out-of-bounds memory access issue was found in Quick Emulator QEMU in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vncrefreshserversurface'. A user inside a guest could use this flaw to crash the QEMU process...
Qemu: VNC: memory corruption due to unchecked resolution limit
An out-of-bounds memory access issue was found in Quick Emulator QEMU in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vncrefreshserversurface'. A user inside a guest could use this flaw to crash the QEMU process...
FFmpeg: Multiple vulnerabilities
Background FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video. Description Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details. gst-plugins-libav is affected because this package is bundli...
CVE-2017-2315
On Juniper Networks EX Series Ethernet Switches running affected Junos OS versions, a vulnerability in IPv6 processing has been discovered that may allow a specially crafted IPv6 Neighbor Discovery ND packet destined to an EX Series Ethernet Switch to cause a slow memory leak. A malicious...
PT-2017-7744
Name of the Vulnerable Software and Affected Versions Firejail affected versions not specified Description The issue allows local users to modify the /etc/resolv.conf file by utilizing a chroot command to /. This can potentially lead to DNS resolution issues or other security problems...
April 11, 2017—KB4015546 (Security-only update)
April 11, 2017—KB4015546 Security-only update Applies To Windows 7 Service Pack 1 Windows Server 2008 R2 Service Pack 1 Improvements and fixes This security update resolves security vulnerabilities in scripting engine, Hyper-V, libjpeg image-processing library, Adobe Type Manager Font Driver,...
Xen: Privilege Escalation
Background Xen is a bare-metal hypervisor. Description In CIRRUSBLTMODEMEMSYSSRC mode the bitblit copy routine cirrusbitbltcputovideo fails to check wethehr the specified memory region is safe. Impact A local attacker could potentially execute arbitrary code with privileges of Xen QEMU process on...
Detecting and mitigating elevation-of-privilege exploit for CVE-2017-0005
On March 14, 2017, Microsoft released security bulletin MS17-013 to address CVE-2017-0005, a vulnerability in the Windows Win32k component that could potentially allow elevation of privileges. A report from a trusted partner identified a zero-day exploit for this vulnerability. The exploit target...
CVE-2016-5749
NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity XXE attack...
HPESBHF03714 rev.1 - HPE Intelligent Management Center (IMC) PLAT, Local Arbitrary File Download
Potential Security Impact: Local: Arbitrary File Download SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Intelligent Management Center iMC iMC PLAT 7.2 E0403P06 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2017-5795 |...
BookLibrary,3.6.14,SQL Injection
BookLibrary by Ordasoft, 3.6.14, SQL Injection Resolutiion: Update to 3.6.15 Update notice: http://ordasoft.com/News/News/book-library-security-update.html...
CVE-2017-2290
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-age...
W3C High Resolution Time API AnC Attack Vulnerability
The W3C High Resolution Time API is a set of JavaScript interfaces for providing web applications with a sub-millisecond resolution of the current time format. A security vulnerability exists in the W3C High Resolution Time API. The vulnerability can be exploited by an attacker with specially...
How to Import NetScaler exported configuration: File-Introduction and Requirements?
With StoreFront 3.7, we introduced the ability to import an exported configuration from NetScaler Gateway. With the introduction of this feature, we enhance the capabilities previously available by allowing multiple vServers to be imported from a single configuration file. The Remote access...
Code injection
The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/showbug.cgi?id=1167489c9 protection mechanism in place, which makes it...