4193 matches found
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1010 This issue affects OpenSSH if privilege separation is disabled config option UsePrivilegeSeparation=no. While privilege separation is enabled by default, it is documented as a hardening option, and therefore disabling it shoul...
Microsoft Internet Explorer 9 - IEFRAME CView::EnsureSize Use-After-Free (MS13-021)
Microsoft Internet Explorer 9 - IEFRAME CView::EnsureSize Use-After-Free MS13-021 var oElement = document.getElementById"ruby"; var oElement = oElement.parentNode.removeChildoElement; document.write""; document.documentElement.offsetTop; setTimeout"location.reload", 100; !-- Time-lin...
Stored Cross-Site Scripting Vulnerability in SS-Panel
SS-Panel is a front-end program that works with Shadowsocks-Manyuser. A stored cross-site scripting vulnerability exists in SS-Panel version 3.3.9. Since HttpOnly is not enabled by default, an attacker can exploit the vulnerability to obtain an administrator cookie and use the cookie to log in to...
XenMobile user shows as "Anonymous" in XenMobile Admin Console
Within the XenMobile console, under the user column, few users started showning as anonymous. In zdm.logs we might see:User '[email protected]' not found or is disabled. Switching to anonymous mode...
Extreme ExtremeXOS OpenSSL Vulnerability (VN-2016-002)
Extreme ExtremeXOS is prone to an OpenSSL vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:extremenetworks:exos"; i...
VulnCheck KEV: CVE-2016-8870
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting...
Account creation vulnerability in Joomla!
Joomla! is a PHP-based open source content management system CMS. Can be used to build commercial Web sites , personal blogs , information management systems , Web services , etc. , but also for secondary development to expand the scope of use . An account creation vulnerability exists in Joomla!...
MGASA-2016-0359 Updated java-1.8.0-openjdk packages fix security vulnerability
It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions CVE-2016-5582...
UBUNTU-CVE-2016-5288
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox 49.0.2...
[20161001] - Core - Account Creation
Inadequate checks allows for users to register on a site when registration has been disabled...
Atlassian Confluence Server 5.8.x < 5.8.6 Multiple Vulnerabilities
Binary data 9645.prm...
Debian DLA-598-1 : suckless-tools security update
It was discovered that the slock screen locking tool would segfault when the user's account had been disabled. slock called crypt3 and used the return value for strcmp3 without checking to see if the return value of crypt3 was a NULL pointer. If the hash returned by getspnam-sppwdp was invalid,...
Error:"Unable to launch your app....Cannot connect to the Citrix XenApp server. SSL Error 4... The server rejected the connection."
Error: "Unable to launch your application. Contact your help desk with the following information: Cannot connect to the Citrix XenApp server. SSL Error 4: Attempted to connect using the TLS V1.0 | SSL V3.0 protocols. The server rejected the connection" whentrying to launch apps when SSL v3 and TL...
Solaris 10 (x86) : 152101-62 (deprecated)
JavaSE 8x86: update 162 patch equivalent to JDK 8u162, 64bit. Date this patch was last updated by Sun : Jan/16/18 This plugin has been deprecated and either replaced with individual 152101 patch-revision plugins, or deemed non-security related. C Tenable Network Security, Inc. @DEPRECATED@ Disabl...
Microsoft Edge and Internet Explorer CVE-2016-3276 Spoofing Vulnerability
Description Microsoft Edge and Internet Explorer are prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected...
The vulnerability of the Cisco Wireless LAN Controller 4400 software allows for circumventing access restrictions.
Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to the widespread use of the Aironet IOS software. This leads to a state where the controller acts as an administrative HTTP server. Exploiting this vulnerability allows malicious actors to bypass access restrictions by...
The vulnerability of the Firefox browser allows a hacker to gain access to a full list of disabled plugins.
The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to gain access to a complete list of disabled plugins, by using cascading style sheets and pseudo-classes...
Netgear device web interface login password disclosure vulnerability
Netgear is a global leader in enterprise networking solutions and a champion of digital home networking applications. A web interface login password disclosure vulnerability exists in several Netgear devices. When password recovery is disabled, an attacker with access to the internal network or...
overcloud-full: Default root password set
An issue was discovered in the image build process for the overcloud images, as used by director, resulting in all previous images to have a default root password of "rootpw". Remote root access via SSH is disabled by default...
CVE-2016-4474
An issue was discovered in the image build process for the overcloud images, as used by director, resulting in all previous images to have a default root password of "rootpw". Remote root access via SSH is disabled by default...