Information disclosure

An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

UBUNTU-CVE-2017-0630

An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

CVE-2017-0630

An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

CVE-2017-0630

CVE-2017-0630 : Information disclosure in Android’s kernel trace subsystem. An attacker must first compromise a privileged process to access data beyond its permissions. Affected products include Android kernel versions 3.10 and 3.18 (Android ID A-34277115). The description notes an information d...

CVE-2017-0630: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

CVE-2017-0630

An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

Google Android Kernel Trace Subsystem Information Disclosure Vulnerability

Android on Nexus 5X is a Linux-based open source operating system developed by Google and the Open Handheld Alliance OHA for the Nexus 5X and other smart devices. kernel trace subsystem is a component of the kernel trace system that is used in it. An information disclosure vulnerability exists in...

Fixed in Apache Tomcat 9.0.0.M21

Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...

Fixed in Apache Tomcat 8.5.15

Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...

Google Android kernel trace subsystem elevation of privilege vulnerability

Google Android is a Linux-based operating system for smartphone devices. An elevation of privilege vulnerability exists in the Google Android kernel trace subsystem, which can be exploited by a remote attacker to build a malicious application that can be elevated in privilege by inducing a user t...

Oracle VirtualBox Guest Additions 5.1.18 - Unprivileged Windows User-Mode Guest Code Double-Free

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1227 We have discovered a heap double-free vulnerability in the latest version of VirtualBox 5.1.18, with Guest Additions and more specifically shared folders enabled in the guest operating system. The heap memory corruption take...

WordPress: plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabled

Background A Cross-Site Tracing XST attack involves the use of Cross-site Scripting XSS and the TRACE HTTP method. According to RFC 2616, "TRACE allows the client to see what is being received at the other end of the request chain and use that data for testing or diagnostic information." XST coul...

Homebrew: Stack Trace on jenkins.brew.sh

221833 is not fully patched. Kindly take a look at https://jenkins.brew.sh/jacegisecuritycheck still stack traces are visible. Let me know if any further info required. Best Regards, MrR3boot...

Opmantek NMIS Command Injection Vulnerability

Opmantek is a developer of opensource IT infrastructure management and auditing software. A command injection vulnerability exists in Opmantek NMIS. This allows attackers to inject via man, finger, ping, trace, and nslookup commands in tools.pl CGI scripts...

CVE-2016-6534: Improper Neutralization of Special Elements used in a Command

Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affected in non-default configurations...

Apple WebKit - WebCore::toJS Use-After-Free

Apple WebKit - WebCore::toJS Use-After-Free function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==25184==ERROR: AddressSanitizer: heap-use-after-free on address...

HTTP TRACE Allowed

The HTTP TRACE method allows a client to send a request to the server, and have the same request sent back in the server's response. This allows the client to determine if the server is receiving the request as expected. Often this method is used for debugging purposes e.g. to verify that a reque...

LDAP SSL - invalid user account-LdapErr-DSID-0C090FB4-Error-initializing-SSL

ISSUE: User can not login after changing LDAP authentication to LDAP SSL authentication. Error message: Invalid user account. Symptom: Check the Network Trace and found. For TLS: 22283 2017-03-09 16:54:29.344825357 2.2.2.22.2.2.3LDAP 232 extendedResp1 00000000: LdapErr: DSID-0C090FB4, comment:...

wireshark: WCP dissector crash (wnpa-sec-2015-14)

A flaw was found in WCP dissector of wireshark of which an attacker could crash wireshark by injecting a specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file...

wireshark: Reassembly memory leak (wnpa-sec-2015-16)

A flaw was found in the way packet reassembly code of wireshark would parse a packet which could leak memory. An attacker could use this flaw to crash wireshark by sending a specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file...