Debian: Security Advisory (DSA-4288-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-15480

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The cloud API had a hidden parameter, which allowed an authenticated...

Design/Logic Flaw

An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger...

CVE-2018-3832

Summary: Insteon Hub with firmware 1013 is vulnerable to an MPFS upload flaw. The HTTP server accepts uploading arbitrary MPFS binaries via /mpfsupload and can trigger unsigned firmware updates via firmware.htm, allowing full firmware flashing with no signature checks. Credentials are required to...

CVE-2018-4942

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure...

Thinkphp3.2.3最新版update注入漏洞

原文来自安全客，作者：0r3ak@0kee Team 原文： 简要描述 thinkphp是国内著名的php开发框架，有完善的开发文档，基于MVC架构，其中Thinkphp3.2.3是目前使用最广泛的thinkphp版本，虽然已经停止新功能的开发，但是普及度高于新出的thinkphp5系列，由于框架实现安全数据库过程中在update更新数据的过程中存在SQL语句的拼接，并且当传入数组未过滤时导致出现了SQL注入。 Git补丁更新 新增加了BIND表达式 漏洞详情...

Design/Logic Flaw

The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server WAS 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 does not properly update passwords on a configuration using Tivoli Directory Server, which might allow...

CVE-2011-4889

CVE-2011-4889 affects IBM WebSphere Application Server via the Virtual Member Manager. The root cause is aPassword update flaw in the Tivoli Directory Server configuration caused by the javax.naming.directory.AttributeInUseException, which might allow a remote attacker to gain access using an old...

SUSE-SU-2018:0179-1 Security update for wireshark

This update for wireshark to version 2.2.12 fixes the following issues: - CVE-2018-5334: IxVeriWave file could crash bsc1075737 - CVE-2018-5335: WCP dissector could crash bsc1075738 - CVE-2018-5336: Multiple dissector crashes bsc1075739 - CVE-2017-17935: Incorrect handling of '\n' in filereadline...

The vulnerability of Cisco’s product update mechanisms on the Cisco Voice Operating System allows a hacker to gain unauthorized access to devices.

The vulnerability of Cisco’s product update mechanisms on the Cisco Voice Operating System is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to devices with root privileges using a...

Debian: Security Advisory (DLA-907-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[ASA-201711-15] lib32-openssl: multiple issues

Arch Linux Security Advisory ASA-201711-15 ========================================== Severity: Medium Date : 2017-11-08 CVE-ID : CVE-2017-3735 CVE-2017-3736 Package : lib32-openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-478 Summary ======= The package...

SUSE-SU-2017:2628-1 Security update for openstack-glance

This update for openstack-glance fixes the following issues: - Restrict imagelocation metadata When showmultiplelocations is enabled in Glance, any user can rewrite the metadata information for locations, causing a security breach. bsc1023507...

Debian DLA-1068-1 : git security update

Joern Schneeweisz discovered that git, a distributed revision control system, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command, for instance via git submodules. For Debian 7 'Wheezy', these problems have been fixed in version...

RedHat Update for freeradius RHSA-2017:2389-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-10966

An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table...

USN-3346-1 bind9 vulnerabilities

Clément Berthaux discovered that Bind did not correctly check TSIG authentication for zone update requests. An attacker could use this to improperly perform zone updates. CVE-2017-3143 Clément Berthaux discovered that Bind did not correctly check TSIG authentication for zone transfer requests. An...

SUSE-SU-2017:1736-1 Security update for bind

This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into 1 providing an...

Code injection

Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers...

BanManager WebUI PHP Code Injection Vulnerability

BanManager is a SQL-based disablement management system. A PHP code injection vulnerability exists in BanManager WebUI version 1.5.8. The vulnerability can be exploited to execute arbitrary code because the 'setting.php' page does not validate the input parameters when doing an update operation...