CVE-2017-12713

An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.220170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts...

Amazon Macie and Deep Security

Amazon S3 stores trillions of objects and regularly peaks at millions of requests per second. By any metric, it’s massive. With unparalleled durability and availability, it’s the backbone of AWS’ data services. This morning at the AWS Summit in New York City, AWS launched a new service: Amazon...

Debian DSA-3936-1 : postgresql-9.6 - security update

Several vulnerabilities have been found in the PostgreSQL database system : - CVE-2017-7546 In some authentication methods empty passwords were accepted. - CVE-2017-7547 User mappings could leak data to unprivileged users. - CVE-2017-7548 The loput function ignored ACLs. For more in-depth...

FreeBSD : PostgreSQL vulnerabilities (982872f1-7dd3-11e7-9736-6cc21735f730)

The PostgreSQL project reports : - CVE-2017-7546: Empty password accepted in some authentication methods - CVE-2017-7547: The 'pgusermappings' catalog view discloses passwords to users lacking server privileges - CVE-2017-7548: loput function ignores ACLs %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] [DSA 3936-1] postgresql-9.6 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3936-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 10, 2017 https://www.debian.org/security/faq -...

PostgreSQL vulnerabilities

The PostgreSQL project reports: CVE-2017-7546: Empty password accepted in some authentication methods CVE-2017-7547: The "pgusermappings" catalog view discloses passwords to users lacking server privileges CVE-2017-7548: loput function ignores ACLs...

Debian: Security Advisory (DSA-3936-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-8038: Credentials readable from CredHub endpoint | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected Credhub-release version 1.1.0 only Description CredHub access control lists ACLs enforce whether an authenticated user can perform an operation on a credential. For installations using ACLs, the ACL was bypassed for the CredHub...

CVE-2017-6672

A vulnerability in certain filtering mechanisms of access control lists ACLs for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. More Information: CSCvb99022...

Cisco ASR 5000 Series Aggregation Services Routers Access Control List Security Bypass Vulnerability

A vulnerability in certain filtering mechanisms of access control lists ACLs for Cisco ASR 5000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. The vulnerability exists because the affected...

Fedora 26 : 1:dovecot (2017-e8b639c286)

quota: Add plugin quotamaxmailsize setting to limit the maximum individual mail size that can be saved. + imapc: Add imapcfeatures=delay-login. If set, connecting to the remote IMAP server isn't done until it's necessary. + imapc: Add imapcconnectionretrycount and imapcconnectionretryinterval...

F5 Networks BIG-IP : IPv6 fragmentation vulnerability (K57211290)

An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big PTB messages. The scope of this CVE is all affected IPv6 implementations from all vendors. The security implications of IP fragmentation have been discussed at length in RFC6274 and RFC7739. An attacker can...

Debian DSA-3865-1 : mosquitto - security update

It was discovered that pattern-based ACLs in the Mosquitto MQTT broker could be bypassed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3865. The text itself is copyright C Software in t...

Debian Security Advisory DSA 3865-1 (mosquitto - security update)

It was discovered that pattern-based ACLs in the Mosquitto MQTT broker could be bypassed. OpenVAS Vulnerability Test $Id: deb3865.nasl 7335 2017-10-02 11:53:53Z teissa $ Auto-generated from advisory DSA 3865-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c...

Fedora 24 : 1:dovecot (2017-da4ed58fd5)

quota: Add plugin quotamaxmailsize setting to limit the maximum individual mail size that can be saved. + imapc: Add imapcfeatures=delay-login. If set, connecting to the remote IMAP server isn't done until it's necessary. + imapc: Add imapcconnectionretrycount and imapcconnectionretryinterval...

CVE-2017-5642

During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs...

CVE-2017-5642

During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs...

CVE-2017-5642

CVE-2017-5642 affects Apache Ambari Server during installation of versions 2.4.0–2.4.2, where Ambari Server artifacts are not created with proper ACLs. This is a design/ACL misconfiguration issue that can impact confidentiality, integrity, and availability of artifacts (per the NVD entry: CVSS ba...

CVE-2017-5642

During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs...

OracleVM 3.3 / 3.4 : coreutils (OVMSA-2017-0052)

The remote OracleVM system is missing necessary patches to address critical security updates : - clean up empty file if cp is failed Orabug 15973168 - pure rebuild to bring back support for aclextendedfilenofollow on x8664 - su: deny killing other processes with root privileges CVE-2017-2616 - fi...