CVE-2019-12959

Server Side Request Forgery SSRF exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter...

opensc: Buffer overflow handling string concatention in tools/util.c:util_acl_to_str()

A buffer overflow when handling string concatenation in utilacltostr in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impact...

EulerOS 2.0 SP2 : util-linux (EulerOS-SA-2019-1737)

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.CVE-2014-9114 Note that Tenable Network Security has extracted...

EulerOS Virtualization for ARM 64 3.0.2.0 : util-linux (EulerOS-SA-2019-1694)

According to the version of the util-linux packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.CVE-2014-9114 Note that Tenable...

EulerOS 2.0 SP5 : util-linux (EulerOS-SA-2019-1670)

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.CVE-2014-9114 Note that Tenable Network Security has extracted...

CVE-2018-9563

In llcputilparsecc of llcputil.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1...

clam-util (>=0.0.5 <=0.1.20), generator-clam (>=0.1.68 <=0.1.86) +2 more potentially affected by CVE-2019-10746 via mixin-deep (=1.0.1)

mixin-deep NPM version =1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - clam-util =0.0.5, =0.1.68, =0.3.0, =0.4.12 - grunt-formatdata =0.1.1 Source cves: CVE-2019-10746 Source advisory: SNYK:JS-MIXINDEEP-450212...

EulerOS Virtualization 3.0.1.0 : util-linux (EulerOS-SA-2019-1462)

According to the version of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use thi...

Man-in-the-Middle Attack

nss-util is vulnerable to a man-in-the-middle attack. The library accepts a wildcard character that is embedded in an internationalized domain name's U-labels in the certTestHostName function in lib/certdb/certdb.c , allowing a malicious user to spoof SSL servers via a crafted certificate...

Open Redirect

The openshift-origin-node-util package provides a set of utility scripts for a node. Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. A flaw was found in the way the administrative web interface for restori...

Cross-site Scripting (XSS)

jetty-util is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the directory listing does not encode characters in UTF-8, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through unicode characters...

Information Disclosure

jetty-util is vulnerable to information disclosure. Eclipse Jetty on Windows reveals the resource base path of files in the directory listings page...

ALPINE-CVE-2019-11455

A buffer over-read in UtilurlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service application outage...

DEBIAN-CVE-2019-11455

A buffer over-read in UtilurlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service application outage...

EulerOS Virtualization 2.5.3 : util-linux (EulerOS-SA-2019-1175)

According to the version of the util-linux package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.i1/4^CVE-2014-9114i1/4%0 Note that Tenable Netwo...

openSUSE Security Update : util-linux (openSUSE-2019-565)

This update for util-linux fixes the following security issue : - CVE-2018-7738: Fix local vulnerability using embedded shell commands in a mountpoint name bsc1084300 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Photon OS 1.0: Util PHSA-2019-1.0-0212

An update of the util package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0212. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid122926;...

Critical Photon OS Security Update - PHSA-2019-0212

Updates of 'rsyslog', 'util-linux', 'python3', 'libsolv', 'linux', 'perl', 'linux-esx', 'runc', 'mysql', 'mesos', 'keepalived' packages of Photon OS have been released...

@descartes/d-editmap (=6.0.0), @descartes/d-geoplateforme (=6.0.0-RC2) +87 more potentially affected by CVE-2016-10583 via closure-util (>=1.15.1 <=1.26.0)

closure-util NPM version =1.15.1, =1.36.0, =0.0.1, =3.6.0, =1.0.0, =0.1.0, =0.3.0, =0.9.0, =0.1.0, =9.0.0, =1.20.2, =2.1.0 and more Source cves: CVE-2016-10583 Source advisory: OSV:GHSA-2HPJ-G53M-9GJ6...

GHSA-2HPJ-G53M-9GJ6 closure-util downloads Resources over HTTP

Affected versions of closure-util insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...