Security Bulletin: A vulnerability in IBM WebSphere Application Server affects IBM PureApplication System

Summary A vulnerability in IBM WebSphere Application Server affects PureApplication System. IBM PureApplication System has addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-1901 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to temporarily gain...

PT-2018-16227 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1013 Description: An exploitable issue exists in the firmware upgrade functionality of the Insteon Hub, triggered via PubNub. The device retrieves signed firmware binaries using plain HTTP requests and does not check the...

Code injection

The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions prior to 2018.1.1 and razor-server and pe-razor-server prior to 1.9.0.0...

CVE-2018-6512

The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions prior to 2018.1.1 and razor-server and pe-razor-server prior to 1.9.0.0...

Xunlei Download Software Upgrade Process Has Arbitrary File Download Vulnerability

Thunderbolt download is free download software based on multi-resource hyperthreading. Xunlei download software in the process of upgrading the arbitrary file download vulnerability, due to the use of insecure HTTP communication protocol to interact with the server, the attacker can take advantag...

[ASA-201803-4] dhcp: denial of service

Arch Linux Security Advisory ASA-201803-4 ========================================= Severity: High Date : 2018-03-05 CVE-ID : CVE-2018-5733 Package : dhcp Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-646 Summary ======= The package dhcp before version 4.4.1-1 is...

CVE-2017-9286

The packaging of NextCloud in openSUSE used /srv/www/htdocs in an unsafe manner, which could have allowed scripts running as wwwrun user to escalate privileges to root during nextcloud package upgrade...

Debian: Security Advisory (DLA-1282-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Arbitrary File Download Vulnerability in CAJViewer, a Specialized Reader for China Knowledge Network (CNN)

CAJViewer is a series of CAJViewer products of National Engineering Research Center of CD-ROM and Tsinghua Tongfang Knowledge Network Beijing Technology Co., Ltd. and a special full-text format viewer for China Periodicals Network CJN, which supports TEB, CAJ, NH, KDH, and PDF format files of CJN...

Debian DLA-1061-1 : newsbeuter security update

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine. For Debian 7 'Wheezy', these problems have been fixe...

CVE-2017-8078

On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication httpupg.cgi with a parameter called cmd. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...

CVE-2017-8078

On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication httpupg.cgi with a parameter called cmd. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...

CVE-2016-5302

Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management network to "compromise" a host by leveraging credentials for an Active Directory account...

Debian Security Advisory DSA 3519-1 (xen - security update)

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure. The oldstable distribution wheezy will be updated in a separate DSA. OpenVAS Vulnerability Test $Id: deb3519.nasl 8008 2017-12-06 10:53:07Z teissa $...

Cisco Desktop Collaboration Experience DX650 Command Injection Vulnerability

Cisco Desktop Collaboration Experience DX650 is a multifunctional endpoint from Cisco replacing Cius targeting the enterprise. The base system is Android. The Cisco Desktop Collaboration Experience DX650 suffers from a command injection vulnerability that allows an attacker to inject shell comman...

Phorum 5.2 versioncheck.php upgrade_available Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based...

MySource 2.14 upgrade_in_progress_backend.php target_url Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15132/info MySource is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

Microsoft IIS 3.0/4.0 Upgrade BDIR.HTR Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2280/info Microsoft Internet Information Server IIS 3.0 came with a series of remote administration scripts installed in /scripts/iisadmin off the web root directory. ism.dll is required for processing these scripts, and...

Debian Security Advisory DSA 2863-1 (libtar - directory traversal)

A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tarextractglob an...

Design/Logic Flaw

nagios.upgradetov3.sh, as distributed by Red Hat and possibly others for Nagios Core 3.4.4, 3.5.1, and earlier, allows local users to overwrite arbitrary files via a symlink attack on a temporary nagioscfg file with a predictable name in /tmp/...