CVE-2018-13284

Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : QEMU vulnerabilities (USN-3923-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3923-1 advisory. Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol MTP. An attacker inside the guest could u...

USN-3923-1: QEMU vulnerabilities

Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol MTP. An attacker inside the guest could use this issue to read or write arbitrary files and cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.10. CVE-2018-16867...

USN-3923-1 qemu vulnerabilities

Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol MTP. An attacker inside the guest could use this issue to read or write arbitrary files and cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.10. CVE-2018-16867...

The vulnerability of the Openwsman package for the Red Hat Enterprise Linux operating system, which allows a hacker to disclose protected information

The vulnerability of the Openwsman package for the Red Hat Enterprise Linux operating system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to disclose protected information by sending a specially crafted HTTP request remotely...

The vulnerability of the TFTP Server component of the Windows Deployment Services service allows a perpetrator to execute arbitrary code.

The vulnerability of the TFTP Server component of the Windows Deployment Services service exists due to errors in memory object handling. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially crafted request...

ALPINE-CVE-2019-3858

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory...

CVE-2018-15906

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

UBUNTU-CVE-2019-9809

If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resources through invalid credentials or locations. These messages cannot be immediately dismissed, allowing for a denial of service DOS attack. This...

UBUNTU-CVE-2019-9807

When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this text as the content. This could potentially be used for social engineering attacks. This vulnerability affects Firefox 66...

The vulnerability of the TFTP file transfer protocol implementation in Cisco IOS XR allows a hacker to disclose sensitive information.

The vulnerability of the TFTP file transfer protocol implementation in Cisco IOS XR operating systems is related to security flaws in the mechanisms used for protection. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

The vulnerability of the libcurl library, related to reading beyond the buffer boundaries of memory, allows an attacker to cause a service failure.

The vulnerability of the libcurl library relates to reading data beyond the buffer boundaries for SMTP communication. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

CVE-2019-3712

Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on the system with privileges of the FTP...

Cisco Network Convergence System 1000 Series IOS XR Software Information Disclosure Vulnerability

Cisco Network Convergence System 1000 Series is a set of network convergence system of the United States Cisco Cisco. An information disclosure vulnerability exists in the IOS XR Software prior to version 6.5.2 in the Cisco Network Convergence System 1000 Series, which stems from the program's...

httpd: DoS for HTTP/2 connections by continuous SETTINGS frames

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

The vulnerability of the Outside In Filters component within the software development kit (SDK) of Outside In Technology allows a hacker to trigger a service failure.

The vulnerability of the Outside In Filters component within the software development kit SDK of Outside In Technology is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the HTTP protocol...

The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK allows a hacker to trigger a service failure.

The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to trigger a service failure using the HTTP protocol...

The vulnerability of the Outside In Filters component of the software development kit (SDK) from Outside In Technology allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the Outside In Filters component within the software development kit SDK of Outside In Technology is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using th...

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite system allows a perpetrator to alter the access rights to files.

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite system is related to insufficient access control. Exploiting this vulnerability could allow an attacker, operating remotely, to alter the access rights to files using th...

The vulnerability of the Integrator component of the Oracle Endeca Information Discovery Integrator software, which allows a malicious individual to gain unauthorized access to protected data.

The vulnerability of the Integrator component of the Oracle Endeca Information Discovery Integrator software for data collection and analysis is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...