CVE-2017-15270: Improper Input Validation

The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values CSV file. This can be used by attackers to hide data in the Graphical User Interface GUI view and create arbitrary entries to a certain extent. Special characters such as '"' and ',' a...

TinyWebGallery Add/Create Module Cross-Site Scripting Vulnerability

TinyWebGallery TWG is a software developer Michael Dempfle developed a set of open source album based on Ajax, PHP and XML , it provides text and image watermarking , slide show , image uploading and management features such as Add/Create module is one of the Add/Create module. A cross-site...

CloudBees Jenkins Script Security plugin security bypass vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Script Security is one of the plug-ins used to detect the script security . A...

CVE-2017-15582

In net.MCrypt in the "Diary with lock" aka WriteDiary application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, which makes it easier for attackers to obtain the cleartext of stored diary entries...

Troubleshooting NetScaler and NetScaler Gateway License Issues

Find the resolution based on the exact error message in the /var/log/license.log file. An Invalid Entry in /nsconfig/hosts An Invalid Entry in /nsconfig/rc.conf An Invalid Date in the System An Expired License A Corrupted License File An Invalid Entry in /nsconfig/hosts Error 1:33:22 lmgrd Unknow...

Disassembler and Runtime Analysis

This post was authored by Paul Rascagneres.IntroductionIn the CCleaner 64bit stage 2 previously described in our blog, we explained that the attacker modified a legitimate executable that is part of "Symantec Endpoint". This file is named EFACli64.dll. The modification is performed in the runtime...

GNU Binutils libbfd dwarf2.c read_formatted_entries denial of service vulnerability

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utilities developed by the GNU Project to work with object files in a variety of formats, with connectors, assemblers, and other tools for object files and archives.The Binary File Descriptor BFD library a.k.a...

Default credentials

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...

CVE-2017-1000095

CVE-2017-1000095 concerns the Jenkins Script Security plugin where the default whitelist contains unsafe entries (DefaultGroovyMethods.putAt and DefaultGroovyMethods.getAt) that bypass sandbox restrictions (e.g., via currentBuild['rawBuild'] vs currentBuild.rawBuild) and allow accessing private d...

CVE-2017-1000095

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...

DEBIAN-CVE-2017-14933

readformattedentries in dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service infinite loop via a crafted ELF file...

Cisco IOS Software for Cisco Catalyst 6800 Series Switches Denial of Service Vulnerability

Cisco Catalyst 6800 Series Switches is a switch device from Cisco USA.IOS is one of the operating systems used for network devices. A denial of service vulnerability exists in the Virtual Private LAN Service VPLS code in the IOS in Cisco Catalyst 6800 Series Switches. An attacker could exploit th...

PT-2017-4195 · Cisco · Cisco Ios +1

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst 6800 Series Switches versions 15.0 through 15.4 Description: A memory management issue in the Virtual Private LAN Service VPLS code of Cisco IOS Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated,...

UBUNTU-CVE-2017-14686

Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d" on Windows. This occurs because readzipdirimp in fitz/unzip.c does not check...

Updated gstreamer0.10-plugins-good and gstreamer1.0-plugins-good packages fix security vulnerabilities

A crafted AAC audio file could have caused an invalid read and thus corruption or denial of service CVE-2016-10198. A crafted mp4 file could have caused an invalid read and thus corruption or denial of service CVE-2016-10199. A crafted AVI file could have caused an invalid read and thus corruptio...

CVE-2015-1854

389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call...

CVE-2015-1854

389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call...

Newsbeuter Remote Command Execution Vulnerability

Newsbeuter is an open source RSS/Atom reader for text terminals running on Unix-like operating systems such as Linux, FreeBSD, and Mac OS X. It can be used in a variety of applications, such as mobile phones, mobile devices, and mobile phones. A security vulnerability exists in the blog playback...

CVE-2015-1854: Improper Access Control

389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call...

Product update: Virtuozzo 7.0 Update 5 Hotfix 2 (7.0.5-642)

The Hotfix 2 for Virtuozzo 7.0 Update 5 provides stability and usability bug fixes. Vulnerability id: PSBM-70653 Unable to connect network adapter to a running VM. Vulnerability id: PSBM-70557 Ghost file limit was ignored when migrating containers. Vulnerability id: PSBM-70551 plooptrim could ent...