727 matches found
PYSEC-2018-82
There is a vulnerability in load method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution...
CVE-2018-20325
There is a vulnerability in load method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution...
PYSEC-2018-82
There is a vulnerability in load method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution...
Ubuntu 18.04 LTS : PostgreSQL vulnerability (USN-3818-1)
The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3818-1 advisory. It was discovered that PostgreSQL incorrectly handled certain trigger definitions when running pgupgrade or pgdump. A remote attacker could possibly use this issu...
USN-3818-1 postgresql-10 vulnerability
It was discovered that PostgreSQL incorrectly handled certain trigger definitions when running pgupgrade or pgdump. A remote attacker could possibly use this issue to execute arbitrary SQL statements with superuser privileges...
xerces-c: Stack overflow when parsing deeply nested DTD
A stack exhaustion flaw was found in the way Xerces-C XML parser handled deeply nested DTDs. An attacker could potentially use this flaw to crash an application using Xerces-C by tricking it into processing specially crafted data...
xerces-c: Stack overflow when parsing deeply nested DTD
A stack exhaustion flaw was found in the way Xerces-C XML parser handled deeply nested DTDs. An attacker could potentially use this flaw to crash an application using Xerces-C by tricking it into processing specially crafted data...
OracleVM 3.4 : xen (OVMSA-2018-0251) (Foreshadow)
The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: xen commit=18ec2b68e519646188fd26a05b2cd26ebd829035 - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff - BUILDINFO: QEMU traditional...
CVE-2018-11048
Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance IDPA versions 2.0, 2.1 contain a XML External Entity XXE Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to...
ansible-tower: Remote code execution by users with access to define variables in job templates
Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server...
Security Bulletin: Vulnerability in RC4 stream cipher affects IBM WebSphere MQ (CVE-2015-2808)
Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM WebSphere MQ. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...
Microsoft Windows Defender AV: Number of days before virus definitions are outdated
This test checks the setting for policy OpenVAS Vulnerability Test $Id: defavdaysbeforevirusoutdated.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Windows Defender AV: Define the number of days before virus definitions are considered out of date Authors: Emanuel Moss Copyright: Copyrigh...
VulnCheck KEV: CVE-2014-6277
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service uninitialized memory access, and untrusted-pointer read and write operations via a crafted...
CVE-2017-17658
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobDefinitions Get method requests. The issue...
Quest NetVault Backup 'NVBUJobDefinitions Get' Method SQL Injection Vulnerability
Quest NetVault Backup is a suite of data backup software from Quest Software, USA. A SQL injection vulnerability exists in the handling of NVBUJobDefinitions Get method requests in Quest NetVault Backup, which stems from the program failing to properly detect user-submitted strings before using S...
“The 101” – Episode 14 – What Makes Up a Cyberattack? (Part 2)
We’re back with another episode of The 101! This regular security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. Last episode we started answering a pivotal...
“The 101” – Episode 13 – What Makes Up a Cyberattack? (Part 1)
We’re back with another episode of The 101! This regular security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. Sometimes in security we find ourselves using...
CVE-2017-15936
In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed...
CVE-2017-15936
Artica Pandora FMS 7.0 contains a Cross‑Site Scripting vulnerability. An attacker with write permission can create an agent carrying an XSS payload, which executes when a user visits the agent definitions page. The underlying root cause is not specified in the provided documents. The exact affect...
