[SECURITY] Fedora 27 Update: slf4j-1.7.25-4.fc27

The Simple Logging Facade for Java or SLF4J is intended to serve as a simple facade for various logging APIs allowing to the end-user to plug in the desired implementation at deployment time. SLF4J also allows for a gradual migration path away from Jakarta Commons Logging JCL. Logging API...

[SECURITY] Fedora 26 Update: slf4j-1.7.22-5.fc26

The Simple Logging Facade for Java or SLF4J is intended to serve as a simple facade for various logging APIs allowing to the end-user to plug in the desired implementation at deployment time. SLF4J also allows for a gradual migration path away from Jakarta Commons Logging JCL. Logging API...

Sql injection

Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands through the Mercurial adapter via vectors involving a branch whose name begins with a --config...

CVE-2017-18026

Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands through the Mercurial adapter via vectors involving a branch whose name begins with a --config...

The vulnerability of Airtame HDMI adapter’s microprogramming software, related to access control deficiencies, allows a intruder to gain unauthorized access to the control interface.

The vulnerability of the Airtame HDMI adapter’s microprogramming software is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the control interface. This could result in forced system reboots,...

thoughtbot Paperclip ruby gem server-side request forgery vulnerability

The thoughtbot Paperclip ruby gem is an open source Ruby-based file attachment manager from thoughtbot, USA. A server-side request forgery vulnerability exists in the Paperclip::UriAdapter class in the thoughtbot Paperclip ruby gem 3.1.4 and later versions. An attacker can exploit this...

GHSA-MW35-24GH-F82W keycloak-connect and keycloak-js improperly handle invalid tokens

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks...

keycloak-connect and keycloak-js improperly handle invalid tokens

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks...

Server-Side Request Forgery (SSRF)

paperclip is vulnerable to server-side request forgery SSRF attacks. The application automatically loads URLs passed to the URI adapter, allowing a malicious user to pass malicious URLs to the application to gain access to sensitive information such as server configuration...

Design/Logic Flaw

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "APFS" component. It does not properly restrict the DMA mapping time of FileVault decryption buffers, which allows attackers to read cleartext APFS data via a crafted Thunderbolt adapter...

CVE-2017-13786

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "APFS" component. It does not properly restrict the DMA mapping time of FileVault decryption buffers, which allows attackers to read cleartext APFS data via a crafted Thunderbolt adapter...

CVE-2017-13786

APFS DMA mapping timing vulnerability in macOS with versions before 10.13.1. The issue allows reading cleartext APFS data via a crafted Thunderbolt adapter due to insufficient restriction of DMA mapping time for FileVault decryption buffers. Apple’s security update 10.13.1 (and related Sierra/El ...

CVE-2017-13786

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "APFS" component. It does not properly restrict the DMA mapping time of FileVault decryption buffers, which allows attackers to read cleartext APFS data via a crafted Thunderbolt adapter...

Active Record contains SQL Injection via improper range quoting

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On security update

Red Hat Single Sign-On 7.1.3 is now available for download from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Wireless Monitoring, Intrusion Detection & Forensics: Nzyme

Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog Open Source log management setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode. Think about this like a long-term months or years...

Product update: Virtuozzo 7.0 Update 5 Hotfix 2 (7.0.5-642)

The Hotfix 2 for Virtuozzo 7.0 Update 5 provides stability and usability bug fixes. Vulnerability id: PSBM-70653 Unable to connect network adapter to a running VM. Vulnerability id: PSBM-70557 Ghost file limit was ignored when migrating containers. Vulnerability id: PSBM-70551 plooptrim could ent...

September 12, 2017—KB4038788 (OS Build 15063.608)

None None...

Lenovo ThinkPad USB 3.0 Ethernet Adapter Driver Elevation of Privilege Vulnerability

Lenovo ThinkPad USB 3.0 Ethernet Adapter is a driver for Ethernet adapter with USB 3.0 interface. A security vulnerability in the Lenovo ThinkPad USB 3.0 Ethernet Adapter allows local attackers to exploit the vulnerability to submit special requests for elevated privileges...

CVE-2017-3746

ThinkPad USB 3.0 Ethernet Adapter part number 4X90E51405 driver, various versions, was found to contain a privilege escalation vulnerability that could allow a local user to execute arbitrary code with administrative or system level privileges...