CVE-2018-20917

Affected product: cPanel prior to 70.0.23. The vulnerability (CVE-2018-20917) stems from an input validation issue and allows any user to disable Solr (SEC-371). This is documented across multiple sources (Red Hat, CNVD, NVD) with impact on availability. Exploitation details are not provided beyo...

Description of the security update for Microsoft Exchange Server 2019 and 2016: June 11, 2019

None None...

Microsoft SharePoint Server CVE-2019-0963 Cross Site Scripting Vulnerability

Description Microsoft SharePoint Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Apple’s FaceTime privacy bug allowed possible spying

Social media caught fire yesterday as the news of a new Apple bug spread. It seemed that there was a flaw in FaceTime that allowed you to place a call to someone, but listen in on their microphone if they didn't pick up. Worse, as the news spread, it turned out that there was also a way to captur...

Apple Disables Group FaceTime Following Major Privacy Glitch

Apple has made Group FaceTime temporarily unavailable following a major flaw discovered on Monday evening. The bug allows anyone with iOS to FaceTime other iOS users and listen in on their private conversations – without the user on other end rejecting or accepting the call. The bug makes use of ...

October 18, 2018—KB4463105 (Preview of Monthly Rollup)

None None...

Cisco Prime Infrastructure TFTP file upload vulnerability

Added: 10/11/2018 BID: 105506 Background Cisco Prime Infrastructure, is a management system of wireless and wired networks. Problem A vulnerability in Cisco Prime Infrastructure allows remote, unauthenticated attackers to execute arbitrary commands by uploading a JSP file via TFTP, and then...

nss security update

3.36.0-9.0.1 - Added nss-vendor.patch to change vendor - Temporarily disable some tests until expired PayPalEE.cert is renewed 3.36.0-9 - Backport upstream fix for CVE-2018-12384 - Remove nss-lockcert-api-change.patch, which turned out to be a mistake the symbol was not exported from libnss...

CVE-2018-16225

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android, which results in an attacker being able to reuse cookies to bypass authentication and...

Information disclosure

The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data vulnerability in OMERO.server that can result in an Attacker gaining full administrative access to server and may be able to disable it. This vulnerability appears to have been...

CVE-2018-1000635

The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data vulnerability in OMERO.server that can result in an Attacker gaining full administrative access to server and may be able to disable it. This vulnerability appears to have been...

Security Bulletin: Vulnerability in SSLv3 affects Tivoli Access Manager for e-business and Security Access Manager for Web (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION:...

Security Bulletin: Vulnerability in RC4 stream cipher in IBM SDK Java Technology Edition, Versions 1.6 and 1.7 affects IBM SPSS Collaboration and Deployment Services (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM SPSS Collaboration and Deployment Services. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Operational Decision Manager

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6,7 and 8 that is used by IBM Operational Decision Manager ODM. These issues were disclosed as part of the IBM Java SDK updates in July 2017 Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTION: An...

CVE-2011-3172

The CVE-2011-3172 issue affects SUSE pam-modules in SUSE Linux Enterprise (prior to version 12). Root cause: unix2_chkpwd could log into disabled accounts due to inadequate checks; a fix was implemented to ensure unix2_chkpwd calls pam_acct_mgmt to block access for locked accounts. Impact: attack...

CVE-2018-0110

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote support account even after it has been disabled via the web application. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server, which would not disable access to...

kernel security and bug fix update

3.10.0-693.11.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-693.11.1 - powerpc perf: Fix book3s kernel to userspace backtraces Gustavo...

TestTrack Server Denial of Service Vulnerability

TestTrack is an open source feature switching system written in Ruby. server is one of the servers. A denial of service vulnerability exists in the split disablement feature in TestTrack Server 1.0 and earlier versions. A remote attacker could use this to cause a denial of service...

ONVIF Camera Snapshot

Nessus was able to acquire a snapshot from the remote camera using the GetProfiles and GetSnapshotUri ONVIF requests. include"compat.inc"; if description scriptid103867; scriptversion"$Revision: 1.3 $"; scriptcvsdate"$Date: 2017/11/15 18:01:11 $"; scriptnameenglish:"ONVIF Camera Snapshot";...

Microsoft Internet Explorer CVE-2017-8733 Spoofing Vulnerability

Description Microsoft Internet Explorer is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Internet Explorer 9, 10 and 11 are...