MunkiReport Cross-Site Request Forgery Vulnerability

Munkireport is a reporting tool for the Munki software management program. A cross-site request forgery vulnerability exists in manager/deletemachine/id in MunkiReport versions prior to 5.6.3. An attacker could exploit this vulnerability to delete arbitrary devices from the MunkiReport database...

CVE-2019-0016 Junos Space: Authenticated user able to delete devices without delete device privileges

A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Spac...

Code injection

The LXC driver lxc/lxcdriver.c in libvirt 1.0.1 through 1.2.1 allows local users to 1 delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; 2 create arbitrary nodes mknod via the virDomainDeviceAttach API and a symlink attack on /dev in th...