Ubuntu 16.04 LTS / 18.04 LTS : Squid vulnerabilities (USN-4289-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4289-1 advisory. Jeriko One discovered that Squid incorrectly handled memory when connected to an FTP server. A remote attacker could possibly use this issue ...

kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege escalation

A flaw was found in the Linux kernel's implementation of GVT-g which allowed an attacker with access to a 'passed through' Intel i915 graphics card to possibly access resources allocated to other virtual machines, crash the host, or possibly corrupt memory leading to privilege escalation...

Unspecified Vulnerability in Oracle PeopleSoft Products PeopleSoft Enterprise HCM Human Resources

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle Corporation. It provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise HCM Human Resources is one of the human resource management...

Exploit for CVE-2014-7911

Security-Data-Analysis-and-Visualization 2018-2020青年安全圈-活跃技术博主/博客 Why - 最初目的：个人日常安全阅读资源不足，需要从博客、Github、Twitter等多个数据源补充。 - 延续目的：以人为核心，系统化收集博客、Github、当前主要研究方向、所属安全组织、学校、公司、RSS、知乎、微博、Email等信息，缩小安全圈的范围。 - 信息检索：通过关键字检索，方便找人，缩小人与人之间的交流障碍。比如通过高校关键字，可以快速找到校友，通过网络ID快速找到博主。 -...

Applied ThreadFix: Fire Bullets, Then Cannonballs – AppSec Edition

The concept of "firing bullets and then cannonballs" comes from the book Great By Choice by Jim Collins and Morten T. Hansen. The idea works a little like this: first fire your "bullets" - low-cost, low-risk, low-distraction experiments to figure out what will work. This allows you to calibrate...

Privilege escalation

Symantec Endpoint Protection SEP and Symantec Endpoint Protection Small Business Edition SEP SBE, prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the...

Privilege escalation

Symantec Endpoint Protection SEP and Symantec Endpoint Protection Small Business Edition SEP SBE, prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the...

Open-Xchange: SSRF - Guard - Unchecked WKS servers

Note This is different vulnerability than HKP lookup 792953, although it does basically same thing and has same problem, these are independent implementations of key lookup and the vulnerable code isn't shared. Description When encrypting an email, one of strategies to lookup recipient's encrypti...

Open-Xchange: SSRF - Guard - Unchecked HKP servers

Description When encrypting an email, one of strategies to lookup recipient's encryption key is to contact a HKP keyserver specified in DNS records of recipient's domain. Specifically it is DNS SRV records for hkps.tcp. and hkp.tcp., which specify hostname and port of the keyserver. In source cod...

The vulnerability of the Company Dir/Org Chart Viewer component of the PeopleSoft Enterprise HCM Human Resources management platform allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Company Dir/Org Chart Viewer component of the PeopleSoft Enterprise HCM Human Resources management platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

Arbitrary Code Execution

hmtlunit is vulnerable to arbitrary code execution. The application does not prevent Rhinos' access to Java resources such as Java methods. This allows an attacker to execute arbitrary Java code on the system using malicious Javascript code...

Denial of service

A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a way that exhausts system resources and results in a denial of service...

CVE-2020-6855

A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a way that exhausts system resources and results in a denial of service...

[SECURITY] [DLA 2096-1] ruby-rack-cors security update

Package : ruby-rack-cors Version : 0.2.9-1+deb8u1 CVE ID : CVE-2019-18978 This package allowed ../ directory traversal to access private resources because resource matching did not ensure that pathnames were in a canonical format. For Debian 8 "Jessie", this problem has been fixed in version...

CVE-2019-20401

Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery CSRF vulnerabilities...

Squid Information Disclosure Vulnerability (CNVD-2020-04521)

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. Squid suffers from an information disclosure vulnerability that can be exploited by an attacker to obtain information...

The vulnerability of the Hierarchy Diagrammers component in the Oracle Human Resources software allows a hacker to gain access to data for modification, addition, or deletion, to gain unauthorized access to protected information, or to cause partial service interruption.

The vulnerability of the Hierarchy Diagrammers component in Oracle Human Resources software exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, gain unauthorized access to protected...

The vulnerability of the Hierarchy Diagrammers component in the Oracle Human Resources software allows a hacker to gain access to data for modification, addition, or deletion, to gain unauthorized access to protected information, or to cause partial service interruption.

The vulnerability of the Hierarchy Diagrammers component in Oracle Human Resources software exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, gain unauthorized access to protected...

CVE-2020-8449

A flaw was found in squid. Due to incorrect input validation, squid can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters...

IBM Security Directory Server Access Control Error Vulnerability

IBM Security Directory Server is a suite of enterprise identity management software from IBM USA that uses the Lightweight Directory Access Protocol LDAP. The software provides a trusted identity data infrastructure for authentication. IBM Security Directory Server, version 6.4.0, has a security...