2554 matches found
Privilege escalation
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...
CVE-2017-5624
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...
CVE-2017-5624
CVE-2017-5624 affects OnePlus 3/3T OxygenOS before 4.0.3, where the attacker can bypass dm-verity by issuing fastboot oem disable_dm_verity, causing the kernel to verify no partitions and enabling persistent code execution and privilege escalation. Public writeups describe a chain with CVE-2017-5...
CVE-2017-5624: Improper Privilege Management
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...
CVE-2016-8974
IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference ...
Xxe
IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference ...
CVE-2016-8974
IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference ...
CVE-2016-8974
CVE-2016-8974 affects IBM Rhapsody DM/Design Manager (versions 4.0–6.0). The vulnerability is a denial-of-service due to an XML External Entity Injection (XXE) when processing XML, which could also expose sensitive data or exhaust memory. IBM security notes specify affected ranges and fixes: 4.0....
CVE-2016-8974: Improper Restriction of XML External Entity Reference
IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference ...
OnePlus 3/3T: Bootloader disable dm-verity Vulnerability (CVE-2017-5624)
CVE-2017-5624, affecting all versions of OxygenOS to date, allows the attacker to disable dm-verity. The combination of the vulnerabilities enables a powerful attack – persistent highly privileged code execution without any warning to the user and with access to the original user’s data after the...
RHEL 7 : kernel-rt (RHSA-2017:0091)
An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
Important: Red Hat Security Advisory: kernel-rt security and bug fix update
An update for kernel-rt is now available for Red Hat Enterprise MRG 2.5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
Cross-site scripting vulnerability in 'index.php' page of DM website builder system
DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. A cross-site scripting vulnerability exists in the 'index.php' page of the DM website builder system. The program fails to filter...
CVE-2016-0325
CVE-2016-0325 affects IBM Jazz-based CLM stack (Rational CLM/RQM/RRTC/RDNG/RELM/RSA DM and related) with multiple versions vulnerable prior to specific iFixes. The issue allows an authenticated remote attacker to execute arbitrary OS commands via a crafted HTTP request, impacting several CLM comp...
systemd security and bug fix update
219-30.0.1.3 - set 'RemoveIPC=no' in logind.conf as default for OL7.2 22224874 - allow dm remove ioctl to co-operate with UEK3 Vaughan Cao Orabug: 18467469 - add hv dynamic memory support Jerry Snitselaar Orabug: 18621475 - rules: load sg module 1223340 - run: drop mistakenly committed test code...
SQL Injection Vulnerability in DMCODE Parameter of Beijing Imagine Star Cloud Service Center System with Book Discs
The Cloud Service Center System of Imagine Star accompanying CD-ROM is a system platform for the management of accompanying CD-ROM for libraries, archives, electronic reading rooms and other departments. There is a SQL injection vulnerability in the DMCODE parameter of the Beijing Imagine Star Bo...
CVE-2016-5671
Multiple cross-site request forgery CSRF vulnerabilities on Crestron Electronics DM-TXRX-100-STR devices with firmware through 1.3039.00040 allow remote attackers to hijack the authentication of arbitrary users...
CVE-2016-5670
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface...
CVE-2016-5669
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 use a hardcoded 0xb9eed4d955a59eb3 X.509 certificate from an OpenSSL Test Certification Authority, which makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions by leveraging th...