DEBIAN-CVE-2017-16539

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss when certain older Linux kernels are used by leveraging Docker container access to write a "scsi remove-single-device" line to...

UBUNTU-CVE-2017-16539

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss when certain older Linux kernels are used by leveraging Docker container access to write a "scsi remove-single-device" line to...

CVE-2017-16539

CVE-2017-16539 affects Docker Moby up to 17.03.2-ce: DefaultLinuxSpec does not block /proc/scsi pathnames, enabling data loss via writing a scsi remove-single-device line to /proc/scsi/scsi (SCSI MICDROP). Connected docs indicate this issue is addressed in later Docker/SUSE advisories (e.g., dock...

CVE-2017-16539

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss when certain older Linux kernels are used by leveraging Docker container access to write a "scsi remove-single-device" line to...

CVE-2017-16539

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss when certain older Linux kernels are used by leveraging Docker container access to write a "scsi remove-single-device" line to...

PT-2017-14440

Name of the Vulnerable Software and Affected Versions Docker Moby versions prior to 17.03.2-ce Description The issue concerns the DefaultLinuxSpec function in oci/defaults.go, which does not properly block /proc/scsi pathnames. This oversight allows attackers to cause data loss, particularly when...

CVE-2017-3934

Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows man-in-the-middle attackers to expose confidential data via read files on the webserver...

CVE-2017-3935

Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type...

CVE-2017-3933

Embedding Script XSS in HTTP Headers vulnerability in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack...

CVE-2017-3935

Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type...

Code injection

Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type...

CVE-2017-3934

Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows man-in-the-middle attackers to expose confidential data via read files on the webserver...

CVE-2017-3935

CVE-2017-3935 affects McAfee Network Data Loss Prevention (NDLP). All connected sources describe a MIME type sniffing vulnerability where the response body could be interpreted/displayed as a content type different from the intended one, potentially impacting how IE renders the content. The root ...

CVE-2017-3935

Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type...

Rails Denial of Service vulnerability

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service application hang or "data loss," a differen...

High severity vulnerability that affects rails.

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service application hang or "data loss," a differen...

Trend Micro Data Loss Prevention Virtual Appliance 5.2 - Path Traversal Vulnerability

Exploit for linux platform in category web applications Exploit Title: Trend Micro Data Loss Prevention Virtual Appliance 5.2 Web Path Traversal Exploit Author: Leonardo Duarte Contact: http://twitter.com/etakdc Vendor Homepage: http://la.trendmicro.com/la/productos/data-loss-prevention/ Version:...

Vendor BPC Silent on Patching SQL Injection in SmartVista Ecommerce Software

A popular ecommerce platform sold in 60 countries suffers from a SQL injection vulnerability privately disclosed in April that has yet to be patched by the vendor. BPC Banking Technologies of Switzerland has not acknowledged the vulnerability in its SmartVista suite of ecommerce and financial...

Trend Micro Data Loss Prevention Virtual Appliance 5.2 - Path Traversal

Trend Micro Data Loss Prevention Virtual Appliance 5.2 - Path Traversal Exploit Title: Trend Micro Data Loss Prevention Virtual Appliance 5.2 Web Path Traversal Date: 10/11/2017 Exploit Author: Leonardo Duarte Contact: http://twitter.com/etakdc Vendor Homepage:...

Debian DLA-1119-1 : otrs2 security update

An attacker who is logged into OTRS, a Ticket Request System, as an agent with write permissions for statistics can inject arbitrary code into the system. This can lead to serious problems like privilege escalation, data loss, and denial of service. This issue is also known as CVE-2017-14635 and ...