CVE-2019-14287

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a “su...

PT-2019-3519

Name of the Vulnerable Software and Affected Versions Sudo versions prior to 1.8.28 Description The issue allows an attacker with access to a Runas ALL sudoer account to bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user...

CVE-2019-13086

core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...

jenkins: forced migration of user records (SECURITY-1072)

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into...

DEBIAN-CVE-2018-12019

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids...

UBUNTU-CVE-2018-12019

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids...

CVE-2017-16116

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...

CVE-2018-6662

Privilege Escalation vulnerability in McAfee Management of Native Encryption MNE before 4.1.4 allows local users to gain elevated privileges via a crafted user input...

Privilege escalation

Privilege Escalation vulnerability in McAfee Management of Native Encryption MNE before 4.1.4 allows local users to gain elevated privileges via a crafted user input...

CVE-2017-3961

Cross-Site Scripting XSS vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes...

Fedora 26 : xen (2018-eb69078020)

Information leak via crafted user-supplied CDROM XSA-258 1571867 x86: PV guest may crash Xen with XPTI XSA-259 1571878 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Fedora 27 : xen (2018-604574c943)

Information leak via crafted user-supplied CDROM XSA-258 1571867 x86: PV guest may crash Xen with XPTI XSA-259 1571878 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Adobe Flash Player Arbitrary Code Execution Vulnerability (CNVD-2018-07047)

Adobe Flash Player is a widely used, proprietary multimedia program player. An arbitrary code execution vulnerability exists in Adobe Flash Player due to improper handling of user-loaded content by Adobe Flash Player. An attacker can achieve arbitrary code execution by creating specially crafted...

CVE-2018-0113

A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by posting...

Cisco IOS XE Software Diagnostic Shell Path Traversal Vulnerability

A vulnerability in the diagnostic shell for Cisco IOS XE Software could allow an authenticated, local attacker to use certain diagnostic shell commands that can overwrite system files. These system files may be sensitive and should not be able to be overwritten by a user of the diagnostic shell...

Asus asuswrt Login User IP Authentication Insufficient Vulnerability

ASUSWRT, the unified firmware used by ASUS in its latest routers, is a web-based graphical user interface for ASUS routers. An insufficient IP authentication vulnerability exists in the HTTPd server for logged in users in 3.0.0.4.380.7743 and earlier versions of Asus asuswrt. An attacker with...

The vulnerability of Skype for Business and Microsoft Lync messaging programs, related to deficiencies in access control, allows attackers to steal authentication hash codes.

The vulnerability of Skype for Business and Microsoft Lync instant messaging programs is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to steal the authentication hash code which can be reused, using a specially created user profile...

CVE-2017-10784

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name...

CVE-2017-10784

Removed by vendor...

CVE-2017-10784

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name...