1158 matches found
[SECURITY] Fedora 26 Update: libdwarf-20170416-1.fc26
Library to access the DWARF debugging file format which supports source level debugging of a number of procedural languages, such as C, C++, and Fortran. Please see http://www.dwarfstd.org for DWARF specification...
Amazon Linux AMI : tomcat6 (ALAS-2017-810)
It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP...
JSON Libraries Patched Against Invalid Curve Crypto Attack
A number of JSON libraries using the JSON Web Encryption specification JWE to create, sign and encrypt access tokens have been patched against an attack that allows for the recovery of a private key. Researcher Antonio Sanso of Adobe said the go-jose, node-jose, jose2go, Nimbus JOSE+WT and jose4...
CVE-2016-9879
An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...
Design/Logic Flaw
An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...
CVE-2016-9879
An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...
CVE-2016-9879
CVE-2016-9879 affects Spring Security 3.2.x/4.1.x/4.2.x prior to fixed versions. The root cause is how path parameters are handled in the Servlet API: getPathInfo() may include encoded "/" characters, allowing an attacker to bypass security constraints when a request contains a path parameter wit...
Zyxel / Eir D1000 DSL Modem NewNTPServer Command Injection Over TR-064 Exploit
Broadband DSL modems manufactured by Zyxel and distributed by some European ISPs are vulnerable to a command injection vulnerability when setting the 'NewNTPServer' value using the TR-64 SOAP-based configuration protocol. In the tested case, no authentication is required to set this value on...
Security Constraint Bypass
Spring security web is vulnerable to security constraint bypass. It does not consider URL path parameters when processing security constraints. By adding an URL path parameter with an encoded / to a request, an attacker is able to bypass a security constraint. The root cause of this issue is a la...
SISCO MMS-EASE and AX-S4 ICCP Denial of Service Vulnerabilities
SISCO MMS-EASE and AX-S4 ICCP are both products of SISCO Corporation, USA. The former is a set of C programming interfaces APIs for MMS Manufacturing Message Specification and the latter is a set of data sharing software.SNAP-Lite Utility is one of the data mining and analysis components. A...
Microsoft Windows VHDFS Driver Elevation of Privilege (MS16-138: CVE-2016-7226)
An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is due to insufficient specification for a certain flag. A remote attacker can exploit this vulnerability by enticing a user to run a specially crafted executable...
Microsoft Windows VHDFS Driver Elevation of Privilege (MS16-138: CVE-2016-7225)
An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is due to insufficient specification for a certain flag. A remote attacker can exploit this vulnerability by enticing a user to run a specially crafted executable...
Important: Red Hat Security Advisory: resteasy-base security and bug fix update
An update for resteasy-base is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
CVE-2016-4459
It was discovered that specifying configuration with a JVMRoute path longer than 80 characters will cause segmentation fault leading to a server crash...
[SECURITY] Fedora 25 Update: libdwarf-20161001-1.fc25
Library to access the DWARF debugging file format which supports source level debugging of a number of procedural languages, such as C, C++, and Fortran. Please see http://www.dwarfstd.org for DWARF specification...
CVE-2014-5415
Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification ADS TwinCAT components might allow remote attackers to obtain access via the 1 Windows CE Remote Configuration Tool, 2 CE Remote Display service, or 3 TELNET service...
Authentication flaw
Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification ADS TwinCAT components do not restrict the number of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...
CVE-2014-5415 Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function
Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification ADS TwinCAT components might allow remote attackers to obtain access via the 1 Windows CE Remote Configuration Tool, 2 CE Remote Display service, or 3 TELNET service...
CVE-2014-5414
Beckhoff Embedded PC Images (pre-2014-10-22) and Automation Device Specification (ADS) TwinCAT components expose an authentication-bruteforce risk due to not limiting login attempts. This remote vulnerability could allow unauthorized access via brute-force over ADS-related services. Affected buil...