4023 matches found
Amazon Linux AMI : kernel (ALAS-2017-901)
A buffer overflow was discovered in tpacketrcv function in the Linux kernel since v4.6-rc1 through v4.13. A number of socket-related syscalls can be made to set up a configuration when each packet received by a network interface can cause writing up to 10 bytes to a kernel memory outside of a...
USN-3437-1 ocaml vulnerability
Radek Micek discovered that OCaml incorrectly handled sign extensions. A remote attacker could use this issue to cause applications using OCaml to crash, to possibly obtain sensitive information, or to possibly execute arbitrary code...
Medium: kernel
Issue Overview: A buffer overflow was discovered in tpacketrcv function in the Linux kernel since v4.6-rc1 through v4.13. A number of socket-related syscalls can be made to set up a configuration when each packet received by a network interface can cause writing up to 10 bytes to a kernel memory...
CVE-2017-14954
The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to obtain sensitive information, and bypass the KASLR protection mechanism, via a crafted system call...
BSA-2017-435
Security Advisory ID : BSA-2017-435 Component : Apache HTTPD Revision : 3.0: Final Apachehttpdallows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccessfile, or ifhttpd.confhas certain misconfigurations, akaOptionsbleed. This affects th...
Over Half a Million Vehicle Records from SVR Tracking Leaked Online
By Waqas Over Half a Million Vehicle Records from SVR Tracking Leaked This is a post from HackRead.com Read the original post: Over Half a Million Vehicle Records from SVR Tracking Leaked Online...
CVE-2017-14680
ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document...
Important: httpd24, httpd
Issue Overview: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. The attacker sends an unauthenticated OPTIONS HTTP request when attempting t...
CVE-2017-1002151
Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization...
CVE-2017-7441
In Sophos SurfRight HitmanPro before 3.7.20 Build 286 included in the HitmanPro.Alert solution and Sophos Clean, a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak occurs at the driver level, an attacker can use this vulnerability to leak some critical informatio...
CVE-2017-7441
Affected software: Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in HitmanPro.Alert and Sophos Clean). Vulnerability mechanism: crafted IOCTL with code 0x22E1C0 may cause kernel data leaks at the driver level, potentially exposing information such as nt!ExpPoolQuotaCookie. Impact: ...
Virtuozzo 7 : readykernel-patch (VZA-2017-079)
According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A kernel data leak due to an out-of-bound read was found in the Linux kernel in inetdiagmsgsctp,laddrfill and...
Virtuozzo 7 : readykernel-patch (VZA-2017-078)
According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A kernel data leak due to an out-of-bound read was found in the Linux kernel in inetdiagmsgsctp,laddrfill and...
Kernel security update: CVE-2017-9242 and other; Virtuozzo ReadyKernel patch 30.3 for Virtuozzo 7.0.5
The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to Virtuozzo kernel 3.10.0-514.26.1.vz7.33.22 Virtuozzo 7.0.5. Vulnerability id: CVE-2017-7558 A kernel data leak due to an out-of-bound read was found in the Linux kernel in...
ShopsN 2.0 official version of the foreground collection_del method SQL injection vulnerability
ShopsN Mall system is a product of Shanghai Yiso Network Technology Co., Ltd, an enterprise-class commercial standard full-featured allow free commercial use of open source online store full network system. A SQL injection vulnerability exists in the collectiondel method in the frontend of ShopsN...
Redfan iOffice Office Software ioCtlSet.asmx suffers from SQL injection vulnerability
Redfan iOffice.net is a professional mobile OA office automation solution provider, providing mobile OA office automation system for medical, government, enterprise and military units. Red Sail iOffice.net OA Office software ioCtlSet.asmx there is a SQL injection vulnerability, the attacker can u...
Massive Government Data Leak in Sweden
Seems to be incompetence rather than malice, but a good example of the dangers of blindly trusting the cloud...
Carbon Emissions: Oversharing Bug Puts Security Vendor Back in Spotlight
Last week, security firm DirectDefense came under fire for over-hyping claims that Cb Response, a cybersecurity product sold by competitor Carbon Black, was leaking proprietary data from customers who use it. Carbon Black responded that the bug identified by its competitor was a feature, and that...
Vendor Exposes Backup of Chicago Voter Roll via AWS Bucket
Voter registration data belonging to the entirety of Chicago’s electoral roll—1.8 million records—was found a week ago in an Amazon Web Services bucket configured for public access. The data was a backup stored in AWS by Election Systems & Software ES&S, a voting machine and election management...
