JVN#63249051: WordPress plugin "Shortcodes Ultimate" vulnerable to directory traversal

The WordPress plugin "Shortcodes Ultimate" contains a directory traversal vulnerability CWE-22 in the Examples page. Impact Arbitrary local files on the server may be accessed by a logged-in user. Solution Update the Software Update to the latest version according to the information provided by t...

Cisco Ultra Services Framework Staging Server Arbitrary Command Execution Vulnerability

A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The vulnerability is due to improper shell invocations. An attacker could exploit this vulnerability b...

Cybozu Garoon vulnerable to cross-site scripting

Overview Cybozu Garoon provided by Cybozu, Inc. contains a cross-site scripting in the application menu. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact An arbitrary script may be executed on the logged-in user's web browser. Solution Upda...

Cybozu Garoon vulnerable to session fixation

Overview Cybozu Garoon provided by Cybozu, Inc. contains a session fixation. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A remote unauthenticated attacker may perform unintended operation with the logged-in user's privilege. Solution...

CVE-2017-8894

AeroAdmin 4.1 uses an insecure HTTP channel to perform software updates, enabling a man-in-the-middle to hijack an update and execute code on the machine. Connected sources confirm the HTTP update mechanism and MITM risk; no remediation or patch details are provided in the available documents.

MGASA-2017-0193 Updated rxvt-unicode packages fix security vulnerability

The rxvt-unicode package has been patched to harden it against potential integer overflow issues when printing escape sequences...

SNMP Remote Code Execution Vulnerabilities in Cisco IOS and IOS XE Software

The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these...

PT-2017-2513 · Cisco · Cisco Ios +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6 Cisco IOS XE versions 2.2 through 3.17 Description: The Simple Network Management Protocol SNMP subsystem of Cisco IOS contains multiple vulnerabilities due to a buffer overflow...

SUSE-SU-2017:1705-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: Security issue fixed: - CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate authentication bypass. bsc1041445 Non security issue fixed: - Fix case insensitive matching in compiled regular expressions bsc1027243...

DSA-3898-1 expat - security update

Bulletin has no description...

OPENSUSE-SU-2017:1649-1 Security update for go

This update for go fixes the following issues: - CVE-2017-8932: Add patch to fix carry bug in x86-64 P-256 implementation boo1040618 Please note that go applications will need to be rebuilt to get this fix, as all go applications are statically linked. As we are regulary releasing updates to our...

Code injection

Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates...

CVE-2017-3218

Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3218

CVE-2017-3218 affects Samsung Magician updating mechanism. Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software updates; earlier versions use HTTP for updates. This flaw can allow a man-in-the-middle or trusted-network attacker to cause the updater to execute arbitrary code ...

CVE-2017-3218

Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates...

Cisco Virtualized Packet Core-Distributed Instance Denial of Service Vulnerability

A vulnerability in the ingress UDP packet processing functionality of Cisco Virtualized Packet Core-Distributed Instance VPC-DI Software could allow an unauthenticated, remote attacker to cause both control function CF instances on an affected system to reload, resulting in a denial of service Do...

MGASA-2017-0177 Updated catdoc packages fix security vulnerability

Various issues found during fuzzing which may lead to an application crash or have unspecified further impact when the user is tricked into opening specially crafted files boo919228. A lot of segfaults on incorrect or corrupted data...

Microsoft Skype for Business and Lync Server CVE-2017-8550 Remote Code Execution Vulnerability

Description Microsoft Skype for Business and Lync Server are prone to a remote code-execution vulnerability. Successfully exploiting this issue may result in the execution of arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service...

Microsoft Edge CVE-2017-8555 Security Bypass Vulnerability

Description Microsoft Edge is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Technologies Affected Microsoft Edge Recommendations Block external acces...