SUSE-SU-2018:1850-1 Security update for python-paramiko

This update for python-paramiko to version 2.0.8 fixes the following issues: - CVE-2018-7750: transport.py in the SSH server implementation of Paramiko did not properly check whether authentication is completed processing other requests. A customized SSH client could have skipped the authenticati...

YIBAN Easy class education platform cross-site scripting vulnerability

YIBAN Easy class education platform is a one-stop management solution for school resources from YIBAN. A cross-site scripting vulnerability exists in YIBAN Easy class education platform version 2.0. The vulnerability can be exploited by remote attackers to steal user cookies by sending the 'k'...

CVE-2018-0280

A vulnerability in the Real-Time Transport Protocol RTP bitstream processing of the Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient input validation of incoming RTP bitstreams. An attacker...

CVE-2018-8865

In Lantech IDS 2102 2.0 and prior, a stack-based buffer overflow vulnerability has been identified which may allow remote code execution. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

Lantech IDS 2102 Input Validation Vulnerability

The Lantech IDS 2102 is an Ethernet device server. An input validation vulnerability exists in the Lantech IDS 2102 version 2.0 and earlier. A remote attacker could exploit this vulnerability by constructing malicious input to execute arbitrary code...

Microsoft ASP.NET Core Remote Elevation of Privilege Vulnerability

Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft Corporation USA. The framework is used to build cloud-based applications such as web applications, IoT applications, and mobile backends. A privilege vulnerability exists in Microsoft ASP.NET Core version 2.0, which...

CCN-lite Denial of Service Vulnerability (CNVD-2018-05497)

CCN-lite is a lightweight CCNx Content Centric Networking Protocol implementation of the CCN-lite project. A security vulnerability exists in the ccnl-ext-mgmt.c file in CCN-lite versions prior to 2.00. No information about this vulnerability is available at this time, so please stay tuned to CNN...

CCN-lite Out-of-Bounds Access Vulnerability

CCN-lite is a lightweight and functionally interoperable implementation of the CCNx protocol for XEROX PARC. An out-of-bounds access vulnerability exists in CCN-lite versions prior to 2.0.0. An attacker can exploit this vulnerability to cause out-of-bounds access via a route related to sslhalen...

CCN-lite Memory Disclosure Vulnerability

CCN-lite is a lightweight and functionally interoperable implementation of the CCNx protocol for XEROX PARC. A memory leak vulnerability exists in CCN-lite versions prior to 2.0.0. An attacker can cause a denial of service memory consumption by exploiting a failure to allocate memory for comp or...

Microsoft ASP.NET Core Elevation of Privilege Vulnerability (CNVD-2018-00899)

Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft Corporation USA. The framework is used to build cloud-based applications such as web applications, IoT applications, and mobile backends. An elevation of privilege vulnerability exists in Microsoft ASP.NET Core versio...

CVE-2017-15892

Multiple cross-site scripting XSS vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via 1 COMMAND, 2 COMMANDS INSTRUCTION, or 3 DESCRIPTION parameter...

CVE-2017-1342

IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks. IBM X-Force ID: 126457...

CVE-2017-12083

An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the...

Circle with Disney Remote Code Execution Vulnerability (CNVD-2017-33180)

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A remote code execution vulnerability exists in the database update feature in Circle with Disney version 2.0.1. The vulnerability can b...

ALPINE-CVE-2017-11408

In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection...

EFS Software Easy Chat Server Heap Buffer Overflow Vulnerability

EFS Software Easy Chat Server is a simple Web-based chat program from EFS Software. A remote heap buffer overflow vulnerability exists in the register.ghp file in EFS Software Easy Chat Server versions 2.0 through 3.1. The vulnerability can be exploited by a remote attacker to execute arbitrary...

ALPINE-CVE-2017-9354

In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address...

ALPINE-CVE-2017-9352

In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by ensuring that backwards parsing cannot occur...

ALPINE-CVE-2017-9349

In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed in epan/dissectors/packet-dcm.c by validating a length value...

Wireshark NetScaler Denial of Service Vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A denial of service vulnerability exists in the NetScaler file parser in Wireshark...