Jenkins 配置文件路径改动导致管理员权限开放漏洞(CVE-2018-1999001)

CVE-2018-1999001 为配置文件路径改动漏洞。远程且未经授权的攻击者可以通过构造恶意登录凭证，从 Jenkins 主目录下移除 config.xml 配置文件到其他目录，从而导致 Jenkins 服务下次重启时退回 legacy 模式，对匿名用户也会开放管理员权限，如下图所示： CVE-2018-1999001 漏洞利用的条件是需要等待 Jenkins 服务的重启。...

Amazon Linux 2 : kernel (ALAS-2018-1046)

The fs/ext4/inline.c:ext4readinlinedata function in the Linux kernel performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode. The unbound copy can cause memory corruption or...

Cross site request forgery (csrf)

Under certain conditions, on F5 BIG-IP ASM 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, 11.5.1-11.5.6, or 11.2.1, when processing CSRF protections, the BIG-IP ASM bd process may restart and produce a core file...

CVE-2018-5537

CVE-2018-5537 affects F5 BIG-IP TMM when the TMM virtual server uses a HTML or Rewrite profile. Vulnerable: BIG-IP versions 11.2.1–11.5.6, 11.6.0–11.6.3.1, 12.1.0–12.1.3.5, and 13.0.0–13.1.0.5. Root cause: TMM restart during processing of specially prepared HTML from the back end. Impact: tempora...

CVE-2018-5539: Undefined Security Weakness

Under certain conditions, on F5 BIG-IP ASM 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, 11.5.1-11.5.6, or 11.2.1, when processing CSRF protections, the BIG-IP ASM bd process may restart and produce a core file...

CVE-2018-10608

SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may cause denial of service via 100% CPU utilization. Restart of the application is required...

Compatibility update for upgrading to Windows 10, version 1803: July 24, 2018

None None...

Compatibility update for upgrading to Windows 10, Version 1709: July 24, 2018

None None...

CVE-2018-11452

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module All versions V4.33, Firmware variant PROFINET IO for EN100 Ethernet module All versions, Firmware variant Modbus TCP for EN100 Ethernet module All versions, Firmware variant DNP3 TCP for EN100 Ethernet...

RHEL 7 : Red Hat Ceph Storage 3.0 (RHSA-2018:2177)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2177 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system...

Design/Logic Flaw

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of the detection engine processes to run out of memory and thus slow down traffic processing. The vulnerability is due to improper handling of traffic when the...

CVE-2018-0385

A vulnerability in the detection engine parsing of Security Socket Layer SSL protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to the Snort process unexpectedly restarting. The vulnerability is due t...

CVE-2018-0370

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of the detection engine processes to run out of memory and thus slow down traffic processing. The vulnerability is due to improper handling of traffic when the...

CVE-2018-0370

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of the detection engine processes to run out of memory and thus slow down traffic processing. The vulnerability is due to improper handling of traffic when the...

PT-2018-8804 · Cisco · Cisco Firepower System

Name of the Vulnerable Software and Affected Versions: Cisco Firepower System Software affected versions not specified Description: A denial of service condition can occur in the Cisco Firepower System Software due to improper input handling of SSL traffic. This issue arises when the detection...

Microhard Systems 3G/4G Cellular Ethernet And Serial Gateway Denial Of Service

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Service Control DoS Vendor: Microhard Systems Inc. Product web page: http://www.microhardcorp.com Affected version: IPn4G 1.1.0 build 1098 IPn3Gb 2.2.0 build 2160 IPn4Gb 1.1.6 build 1184-14 IPn4Gb 1.1.0 Rev 2 build 1090-2 IPn4Gb 1.1.0 R...

Cisco Firepower System Denial of Service Vulnerability

Cisco Firepower System Software is a next-generation firewall product NGFW from Cisco. A denial of service vulnerability exists in the parsing of Secure Sockets Layer protocol packets in the detection engine of Cisco Firepower System Software, which stems from the program's failure to properly...

Cisco Firepower System Denial of Service Vulnerability (CNVD-2018-16067)

The Cisco Firepower System is the system used by the Cisco Firepower next-generation firewall. A denial of service vulnerability exists in the inspection engine of the Cisco Firepower System. The vulnerability stems from improper handling of traffic after the Secure Sockets Layer SSL inspection...

CVE-2018-0029

While experiencing a broadcast storm, placing the fxp0 interface into promiscuous mode via the 'monitor traffic interface fxp0' can cause the system to crash and restart vmcore. This issue only affects Junos OS 15.1 and later releases, and affects both single core and multi-core REs. Releases pri...

PT-2018-8576

Name of the Vulnerable Software and Affected Versions: Junos OS versions 15.1 through 17.4 Description: The system can crash and restart when the fxp0 interface is placed into promiscuous mode via the 'monitor traffic interface fxp0' command during a broadcast storm. This issue affects both singl...