Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud (CVE-2019-4304, CVE-2019-4305)

Summary There is an information disclosure and a bypass security vulnerability in WebSphere Application Server Liberty. These vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server - Liberty could allow a remote attacker to...

Low: keycloak-httpd-client-install

Issue Overview: It was discovered that keycloak-httpd-client-install uses a predictable log file name in /tmp. A local attacker could create a symbolic link to a sensitive location, possibly causing data corruption or denial of service.CVE-2017-15111 In keycloak-http-client-install prior to versi...

OPENSUSE-SU-2019:2344-1 Security update for tcpdump

This update for tcpdump fixes the following issues: - CVE-2017-16808: Fixed a heap-based buffer over-read related to aoeprint and lookupemem bsc1068716 bsc1153098. - CVE-2018-10103: Fixed a mishandling of the printing of SMB data bsc1153098. - CVE-2018-10105: Fixed a mishandling of the printing o...

CVE-2019-15273

Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint CE Software could allow an authenticated, local attacker to overwrite arbitrary files. The vulnerabilities are due to insufficient permission enforcement. An attacker could exploit these vulnerabilities by...

NewStart CGSL CORE 5.04 / MAIN 5.04 : ntp Vulnerability (NS-SA-2019-0206)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ntp packages installed that are affected by a vulnerability: - Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long...

CVE-2019-17501

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 aka the Configuration Commands Discovery screen. CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same...

CVE-2018-12539

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on...

CVE-2018-16301

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:readinfile. To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump...

Cisco Firepower Threat Defense Input Validation Error Vulnerability

Cisco Firepower Threat Defense FTD is a suite of unified software from the U.S. company Cisco Cisco that provides next-generation firewall services. An input validation error vulnerability exists in the CLI in Cisco FTD. A local attacker could exploit this vulnerability to execute commands with...

CVE-2019-15014

A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system commands in the CLI...

Cisco Firepower Threat Defense Local Elevation of Privilege Vulnerability

Cisco Firepower Threat Defense is a suite of unified software that provides next-generation firewall services. A security vulnerability exists in the Cisco Firepower Threat Defense CLI that allows a local attacker to exploit the vulnerability by submitting a special request to gain ROOT privilege...

The vulnerability of the command-line interface of the Cisco FX-OS network operating system and the Cisco Firepower Threat Defense (FTD) network switches’ micro-programming software allows a attacker to execute arbitrary commands on the privileged root operating system.

The vulnerability of the command-line interface of the Cisco FX-OS network operating system and the Cisco Firepower Threat Defense FTD network interface micro-programming system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute...

iTerm2 with tmux integration is vulnerable to remote command execution

Overview iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution. Description iTerm2 is a popular terminal emulator for macOS that supports terminal multiplexing using tmux integration and is frequently used by developers and system administrator...

Multiple OS command injection vulnerabilities in DBA-1510P

Overview DBA-1510P provided by D-Link Japan K.K. contains multiple OS command injection vulnerabilities listed below. OS command injection vulnerability in Command Line Interface CLI CWE-78 - CVE-2019-6013 OS command injection vulnerability in Web User Interface CWE-78 - CVE-2019-6014 Katsuhiko...

JVN#95875796: Multiple OS command injection vulnerabilities in DBA-1510P

DBA-1510P provided by D-Link Japan K.K. contains multiple OS command injection vulnerabilities listed below. OS command injection vulnerability in Command Line Interface CLI CWE-78 - CVE-2019-6013 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score...

CVE-2018-14879

The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:getnextfile...

DEBIAN-CVE-2018-16301

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:readinfile. To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump...

AZL-8506 CVE-2018-16301 affecting package tcpdump for versions less than 4.99.1-1

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:readinfile. To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump...

ALPINE-CVE-2018-14879

The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:getnextfile...

ALPINE-CVE-2018-16301

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:readinfile. To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump...