Remote code execution

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

CVE-2017-2608

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

CVE-2017-2608

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

CVE-2017-2608

CVE-2017-2608 is a remote-code-execution vulnerability in Jenkins via deserialization in XStream-based APIs (javax.imageio). Affected are Jenkins versions before 2.44 and 2.32.2 (as listed in multiple advisories). The flaw arises from improper validation of user-supplied input before deserializat...

CVE-2017-2608

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

Wallarm Node — now as a Google Cloud image

Today we’re excited to announce native availability of Wallarm Node image for Google Cloud Platform GCP. Many Wallarm customers and prospects use Google Cloud for its high-performance, scalable infrastructure with excellent price/performance. The ability to customize machine types to customer...

IBM API Connect Security Bypass Vulnerability (CNVD-2018-09233)

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in LoopBack APIs for a Model created in IBM API Connect. An attacker...

Tens of Thousands of Malicious Apps Using Facebook APIs

At least 25,936 malicious apps are currently using one of Facebook’s APIs, such as a login API or messaging API. These allow apps to access a range of information from Facebook profiles, like name, location and email address. Trustlook discovered the malicious apps using a formula, which created ...

CVE-2018-1389

IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing unauthorized modification of information. IBM X-Force ID: 138213...

CVE-2018-1389

IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing unauthorized modification of information. IBM X-Force ID: 138213...

Microsoft Windows 10: Create a token object

This policy setting determines which accounts a process can use to create a token, and which accounts it can then use to gain access to local resources when the process uses NtCreateToken or other token-creation APIs. OpenVAS Vulnerability Test $Id: win10createtokenobject.nasl 11532 2018-09-21...

[SECURITY] Fedora 27 Update: corosync-2.4.4-1.fc27

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

CVE-2016-10486

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, and SD 820A, PD failure reason string from user PD is used directly in root PD, s...

Buffer overflow

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, and SD 820A, PD failure reason string from user PD is used directly in root PD, s...

CVE-2016-10486

CVE-2016-10486 affects Android devices with Qualcomm Snapdragon Wireless/Automotive SoCs (e.g., MDM9640/9645, SD 210/212/205, 450, 617, 625, 650/52, 808, 810, 820, 820A, etc.). The root cause is that the PD failure reason string from user PD is used directly in root PD; if the buffer in Diag F3 A...

CVE-2016-10448

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD...

PT-2018-15830 · Oracle +4 · Java Se +7

Name of the Vulnerable Software and Affected Versions: Java SE versions 6u181, 7u171, 8u162, and 10 Java SE Embedded version 8u161 JRockit version R28.3.17 Description: The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded,...

DCShadow

The DCShadow is an attack which tries to modify existing data in the Active Directory by using legitimate API's which are used by domain controllers. This technique can be used in a workstation as a post-domain compromise tactic for establishing domain persistence bypassing most SIEM solutions...

CVE-2016-9646 Commit metadata forgery via CGI::FormBuilder context-dependent APIs

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-field method similar to the CGI-param API that led to Bugzilla's CVE-2014-1572, which can be abused to lead to commit metadata forgery...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which giv...