13962 matches found
Debian DLA-1265-1 : krb5 security update
Kerberos, a system for authenticating users and services on a network, was affected by several vulnerabilities. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2013-1418 Kerberos allows remote attackers to cause a denial of service NULL pointer dereference an...
quagga -- several security issues
Quagga reports: The Quagga BGP daemon, bgpd, does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or it may crash. The Quagga BGP daemon, bgpd, can double-free memor...
SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:0279-1)
This update for libvirt provides several fixes. This security issue was fixed : - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead method which allowed to cause DoS bsc1076500. These security issues were fixed : - Add a qemu hook script providing functionality similar to Xen's...
[SECURITY] Fedora 26 Update: clamav-0.99.2-18.fc26
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
The vulnerability of the auth_password function in the sshd service of the OpenSSH security tool allows a hacker to induce a service failure.
The vulnerability of the authpassword function auth-passwd.c in the sshd service of the OpenSSH encryption protection tool exists due to insufficient input handling mechanisms lack of password length restrictions for authentication. Exploiting this vulnerability allows a malicious actor to cause ...
The vulnerability in the receive_msg function of the receive.c file of the SMTP daemon of the Debian GNU/Linux operating system’s mail server allows a attacker to cause a service failure or execute arbitrary code.
The vulnerability of the receivemsg function in receive.c of the SMTP daemon of the Debian GNU/Linux operating system’s mail server is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure the us...
Asus Unauthenticated LAN Remote Command Execution Exploit
Exploit for hardware platform in category remote exploits Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE...
Asus Unauthenticated LAN Remote Command Execution
Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT...
ASUSWRT Device Unauthenticated Modified Configuration Vulnerability
ASUS AsusWRT is a set of router operating systems from ASUS. A security vulnerability exists in the 'dovpnuploadpost' function in the router/httpd/web.c file of the vpnupload.cgi file in versions prior to ASUS AsusWRT 3.0.0.4.38410007. An attacker can exploit this vulnerability by sending a...
CVE-2016-10708
OpenSSH sshd before 7.4 is vulnerable to a denial of service caused by a NULL pointer dereference when processing an out-of-sequence NEWKEYS message (kex.c/packet.c). This affects the OpenSSH server; exploitation leads to daemon crash as demonstrated by Honggfuzz. Affected products include OpenSS...
CVE-2017-18044
A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted...
CVE-2017-18044
CVE-2017-18044 is a command injection vulnerability in Commvault's ContentStore/Base/CVDataPipe.dll. The issue arises from a message parsing function that passes unchecked input to CreateProcess, enabling a remote attacker to inject and execute commands on the target OS. The flaw is exploitable w...
rsync 'parse_arguments' function protection mechanism bypass vulnerability
rsync is a suite of data mirroring backup applications for Unix-like systems developed by Australian software developers Andrew Tridgell and Paul Mackerras, which synchronizes the updating of files and directories between two computers and reduces data transfers by using differential encoding...
ALPINE-CVE-2018-5764
The parsearguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism...
UBUNTU-CVE-2018-5764
The parsearguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism...
FreeBSD : transmission-daemon -- vulnerable to dns rebinding attacks (3e5b8bd3-0c32-452f-a60e-beab7b762351)
Google Project Zero reports : The transmission bittorrent client uses a client/server architecture, the user interface is the client which communicates to the worker daemon using JSON RPC requests. As with all HTTP RPC schemes like this, any website can send requests to the daemon listening on...
Transmission - RPC DNS Rebinding
Transmission - RPC DNS Rebinding The transmission bittorrent client uses a client/server architecture, the user interface is the client and a daemon runs in the background managing the downloading, seeding, etc. Clients interact with the daemon using JSON RPC requests to a web server listening on...
CVE-2018-0002
On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in...
USN-3526-1 sssd vulnerability
It was discovered that SSSD incorrectly handled certain inputs when querying its local cache. An attacker could use this to inject arbitrary code and expose sensitive information...