PT-2017-4061

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.6.7.1 jackson-databind versions prior to 2.7.9.1 jackson-databind versions prior to 2.8.9 jackson-databind versions 2.0.0 through 2.9.5 Description A deserialization flaw in the jackson-databind library is...

CVE-2016-6209

Cross-site scripting XSS vulnerability in Nagios...

USN-3242-2 samba regression

USN-3242-1 fixed a vulnerability in Samba. The upstream fix introduced a regression when Samba is configured to disable following symbolic links. This update fixes the problem. Original advisory details: Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacke...

PT-2017-17643 · Rancher · Rancher Server

Name of the Vulnerable Software and Affected Versions: Rancher Labs rancher server versions 1.2.0 through 1.2.3 Rancher Labs rancher server versions 1.3.0 through 1.3.4 Rancher Labs rancher server versions 1.4.0 through 1.4.2 Rancher Labs rancher server versions 1.5.0 through 1.5.2 Description: T...

How to disable Workspace Control Session Roaming on Citrix Virtual Apps and Desktops

This article describes how to disable workspace control session roaming from occurringon Citrix Virtual Appsand Desktops...

b2evolution File Upload Vulnerability

b2evolution is prone to a unrestricted file upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

PT-2017-1514 · Microsoft · Browsers +1

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Microsoft browsers affected versions not specified Description: The issue is related to insufficient access restrictions to certain functions in Microsoft browsers, which could allow a remote...

PT-2017-15535 · Pharos · Pharos Popup Printer Client

Name of the Vulnerable Software and Affected Versions: Pharos PopUp printer client version 9.0 Description: A denial of service issue exists in the psnotifyd application. It can be triggered by a specially crafted packet sent to the victim's computer, leading to an out of bounds read, which cause...

DEBIAN-CVE-2015-2877

Kernel Samepage Merging KSM in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection CAIN attack. NOTE: the vendor states "Basically ...

Rockstar Games: SSLv3 POODLE Vulnerability

Tested against POODLE MITM and www.rockstargames.com is vulnerable, i simply went into terminal and used this command "openssl sclient -connect www.rockstargames.com:443 -ssl3" proof attached in image below How to fix: Disable SSLv3...

RedHat Update for kernel RHSA-2017:0323-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands

It was found that IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate...

Authentication Bypass Vulnerability in Weetop CMS Backend

Weetop CMS is a web content management system developed by Hangzhou Tintop Technology Co. An authentication bypass vulnerability exists in the Weetop CMS V2.0 administration backend in the login session check processing mechanism. An attacker can bypass the forced jump without login by disabling...

StoreFront upgrade fails if PriviledgedService and MPSFagent (SCOM) is running

If the Citrix SCOM Management Pack Agent service is installed on the StoreFront server, StoreFront cannot upgrade. To work around this issue, disable the SCOM service before attempting the StoreFront upgrade. Note : This issue is not applicable to StoreFront 3.11 and higher. These services do not...

Sawmill Authentication Bypass Vulnerability

Sawmill is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sawmill:sawmill"; if...

Security update of chromium (important)

Google chromium was updated to 56.0.2924.87: Various small fixes Disabled option to enable/disable plugins in the chrome://plugins - Changed the build requirement of libavformat to library version 57.41.100, as included in ffmpeg 3.1.1, as only this version properly supports the public AVStream A...

PT-2017-1248 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 24.0.0.194 and earlier Description: The issue is related to an integer overflow vulnerability in Flash Broker COM, which could lead to arbitrary code execution if successfully exploited. Recommendations: For Adobe...

PT-2017-1249 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 24.0.0.194 and earlier Description: The issue is related to a heap overflow vulnerability in the Flash Video FLV codec. This vulnerability could be exploited to achieve arbitrary code execution. The vulnerability i...

PT-2017-1250 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 24.0.0.194 and earlier Description: The issue is related to a use after free vulnerability in the ActionScript 3 BitmapData class. This vulnerability is associated with the use of memory after it has been freed...

PT-2017-4233 · Xmlsoft +2 · Libxml2 +2

Name of the Vulnerable Software and Affected Versions: libxml2 version 2.9.4 Description: The issue is related to a denial of service caused by a NULL pointer dereference when libxml2 is used in recover mode. This can be triggered by a remote attacker via a crafted XML document. The maintainer of...