Microsoft Windows: Enumerate administrator accounts on elevation

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winenumadminelevation.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Enumerate administrator accounts on elevation Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net...

Multiple Cisco Products FXOS and UCS Fabric Interconnect Software Input Validation Vulnerabilities

Cisco Firepower 4100 Series Next-Generation Firewall and so on are the products of the American Cisco Cisco company.Cisco Firepower 4100 Series Next-Generation Firewall is a firewall product.UCS 6200 Cisco Firepower 4100 Series Next-Generation Firewall is a firewall product. UCS 6200 Series Fabri...

CVE-2018-0298

A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to incorrect input validation in the web UI. An attacker could exploit this vulnerabili...

Cisco Firepower 4100 Series Next-Generation Firewall and Firepower 9300 Security Appliance Path Traversal Vulnerability

A vulnerability in the process of uploading new application images to the Cisco Firepower 4100 Series Next-Generation Firewall NGFW and Firepower 9300 Security Appliance could allow an authenticated, remote attacker using path traversal techniques to create or overwrite arbitrary files on an...

Security Bulletin: IBM Tivoli Monitoring Agent Framework component. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9843)

Summary IBM Tivoli Monitoring uses zlib compression library in both the General services library and the File Transfer component. This bulletin address several reported vulnerabilities in the zlib compression library. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a...

Security Bulletin: Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services potential Cross Site Scripting vulnerabilities (CVE-2017-1160)

Summary Financial Transaction Manager FTM for ACH Services, Check Services and Corporate Payment Services there are potential Cross Site Scripting vulnerabilities. These have been addressed with CVE-2017-1160. Vulnerability Details CVEID: CVE-2017-1160 DESCRIPTION: IBM Financial Transaction Manag...

McAfee Web Gateway Authentication Bypass Vulnerability

McAfee Web Gateway MWG is a security gateway product from McAfee USA. The product provides threat protection, application control, and data loss prevention. An authentication bypass vulnerability exists in the management user interface in McAfee MWG. A remote attacker could exploit this...

SAP Infrastructure and UI Information Disclosure Vulnerability

SAP Infrastructure and UI are both products of SAP, an IT infrastructure management solution that discovers and manages all network assets on a local area network and continuously monitors asset data. The solution discovers and manages all network assets on the LAN and continuously monitors the...

Sonatype Nexus Repository Manager Cross-Site Scripting Vulnerability (CNVD-2018-11638)

Sonatype Nexus Repository Manager aka NXRM is a maven repository manager. A cross-site scripting vulnerability exists in Sonatype NXRM versions prior to 3.12.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the Administration UI...

CVE-2018-2428

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00...

McAfee Common UI ePO Extension Information Disclosure Vulnerability

McAfee Common UI CUI is a set of user interfaces for managing McAfee products from McAfee, Inc. in the United States. ePO extension is one of the software managers. A security vulnerability exists in the ePO extension in McAfee CUI version 2.0.2. A remote attacker could exploit the vulnerability ...

CVE-2018-6961

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future...

CVE-2017-7812

If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This can allow malicious web content to open a locally stored file through "file:" URLs. This vulnerability affects Firefox 56...

Important: Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update

An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

CVE-2018-0355

A vulnerability in the web UI of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to conduct a cross-frame scripting XFS attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline...

openSUSE: Security Advisory for dpdk-thunderxdpdk (openSUSE-SU-2018:1560-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Apple iOS inkPresentation UI fraud vulnerability

Apple iOS is an operating system developed by Apple for its mobile devices.LinkPresentation is one of the presentation display components. A security vulnerability exists in the handling of URLs in the linkPresentation component in Apple iOS versions prior to 11.3.1. The vulnerability can be...

SUSE-SU-2018:1492-1 Security update for dpdk-thunderxdpdk

This update fixes the following issues: - CVE-2018-1059: The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest...

Command injection

On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on...

IBM Content Navigator Cross-Site Scripting Vulnerability (CNVD-2018-10946)

IBM Content Navigator is a Web client from IBM USA that supports searching and processing documents stored in content servers around the world from a Web browser. A cross-site scripting vulnerability exists in IBM Content Navigator. A remote attacker can exploit this vulnerability to inject...