Stack overflow

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due...

Privilege Escalation

libglusterfs.so is vulnerable to privilege escalation. A malicious user can use an unauthenticated gluster client to connect and mount arbitrary gluster storage volumes that can escalate privileges through a scheduled cronjob...

Debian DLA-1409-1 : mosquitto security update

CVE-2017-7651 fix to avoid extraordinary memory consumption by crafted CONNECT packet from unauthenticated client CVE-2017-7652 in case all sockets/file descriptors are exhausted, this is a fix to avoid default config values after reloading configuration by SIGHUP signal For Debian 8 'Jessie',...

Design/Logic Flaw

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression...

CVE-2018-1112

Summary (CVE-2018-1112) GlusterFS server before 3.10.12 and 4.0.2 is vulnerable when using the auth.allow option. This allows any unauthenticated Gluster client to connect from any network and mount Gluster volumes. The issue is a regression from CVE-2018-1088. Connected advisories corroborate th...

Debian DLA-1334-1 : mosquitto security update

CVE-2017-7651 A crafted CONNECT packet from an unauthenticated client could result in extraordinary memory consumption. CVE-2017-7652 In case all sockets/file descriptors are exhausted, a SIGHUP signal to reload the configuration could result in default config values especially bad security...

AsusWRT LAN - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AsusWRT LAN Unauthenticated Remote Code Execution', 'Description' = %q The HTTP server in AsusWRT has a flaw where it allows an unauthenticated...

CVE-2017-9797

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

CVE-2017-9797

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

Information disclosure

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

CVE-2017-9797

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

Design/Logic Flaw

In TigerVNC 1.7.1 CConnection.cxx CConnection::CConnection, an unauthenticated client can cause a small memory leak in the server...

CVE-2017-7396

In TigerVNC 1.7.1 CConnection.cxx CConnection::CConnection, an unauthenticated client can cause a small memory leak in the server...

Design/Logic Flaw

In TigerVNC 1.7.1 SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt, an unauthenticated client can cause a small memory leak in the server...

CVE-2017-7392

In TigerVNC 1.7.1 SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt, an unauthenticated client can cause a small memory leak in the server...

CVE-2017-7392

In TigerVNC 1.7.1 SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt, an unauthenticated client can cause a small memory leak in the server...

DEBIAN-CVE-2017-7396

In TigerVNC 1.7.1 CConnection.cxx CConnection::CConnection, an unauthenticated client can cause a small memory leak in the server...

UBUNTU-CVE-2017-7392

In TigerVNC 1.7.1 SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt, an unauthenticated client can cause a small memory leak in the server...

UBUNTU-CVE-2017-7396

In TigerVNC 1.7.1 CConnection.cxx CConnection::CConnection, an unauthenticated client can cause a small memory leak in the server...

DEBIAN-CVE-2017-7392

In TigerVNC 1.7.1 SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt, an unauthenticated client can cause a small memory leak in the server...