CentOS Update for kernel CESA-2016:2047 centos7

Check the version of kernel SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882577";...

kernel: remotely triggerable unbounded recursion in the vlan gro code leading to a kernel crash

Linux kernel built with the 802.1Q/802.1ad VLANCONFIGVLAN8021Q OR Virtual eXtensible Local Area NetworkCONFIGVXLAN with Transparent Ethernet BridgingTEB GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path, as an unlimited recursion could...

Libxml2 memory corruption vulnerability in multiple Apple products (CNVD-2016-08340)

Apple iOS, OS X, tvOS, and watchOS are all products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Apple OS X is a specialized operating system developed for Mac computers; tvOS is a smart TV operating system; and watchOS is a smart watch operating system. Libxml2 is...

Polycom HDX Video End Points XML External Entity Denial of Service Vulnerability

Polycom HDX Video End Points video conferencing system. A denial of service vulnerability exists in Polycom HDX Video End Points. An attacker could exploit this vulnerability to cause a denial of service condition...

EAP7 Privilege escalation when managing domain including earlier version slaves

The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges...

jenkins: Remote code execution through remote API (SECURITY-247)

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

The vulnerability of the Microsoft .NET Framework software platform, which allows a hacker to read arbitrary files

The vulnerability of the Microsoft .NET Framework software platform is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to read arbitrary files using XML data, which contains a declaration of an external object along with a reference to an...

Framework: denial-of-service attack with XML input

A denial of service flaw was found in the way Spring processes inline DTD declarations. A remote attacker could submit a specially crafted XML file that would cause out-of-memory errors when parsed...

zFTP Client 20061220 - 'Connection Name' Local Buffer Overflow

Exploit developed using Exploit Pack v5.4 Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: zFTP Client Affected value: NAME under FTP connection Where in the code: Line 30 in strcpychk.c strcpychk dest=0xb7f811c0 "/KUIP", src=0xb76a6680 "/MACRO",...

zFTP Client 20061220 - Connection Name Local Buffer Overflow

zFTP Client 20061220 - Connection Name Local Buffer Overflow Exploit developed using Exploit Pack v5.4 Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: zFTP Client Affected value: NAME under FTP connection Where in the code: Line 30 in strcpychk.c...

zFTP 20061220+dfsg3-4.1 Buffer Overflow

Exploit developed using Exploit Pack v5.4 Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: zFTP Client Affected value: NAME under FTP connection Where in the code: Line 30 in strcpychk.c strcpychk dest=0xb7f811c0 "/KUIP", src=0xb76a6680 "/MACRO",...

CVE-2016-3039

IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authenticated users to read arbitrary files or cause a denial of service memory consumption via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

The vulnerability of Microsoft XML Core Services allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability in Microsoft Windows, related to the processing of XML content, allows attackers to gain access to confidential information...

The vulnerability of the automated system for managing technological processes, KingSCADA, allows a remote attacker to perform a maintenance failure, provided that the user opens a specially crafted XML document.

The vulnerability of the automated system for managing technological processes, KingSCADA, is related to the unsafe processing of external XML entities. Exploiting this vulnerability allows a malicious attacker to perform a service failure, provided that the user opens a specially crafted XML...

DEBIAN-CVE-2016-4472

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and...

python-docx XML External Entity Vulnerability

python-docx is a python library for editing and generating Microsoft Word documents. An XML external entity vulnerability exists in python-docx version 0.8.5. An attacker can exploit this vulnerability to conduct an XML external entity attack...

CA Release Automation Denial of Service Vulnerability

CA Release Automation formerly CA LISA Release Automation is a suite of enterprise-class release automation solutions from CA USA. The solution enables continuous delivery across the application lifecycle and can streamline and execute application releases, centralize application operations from...

Six Apart Movable Type Pro and Advanced SQL Injection Vulnerabilities

Six Apart Movable Type MT is a blogging system from Six Apart Inc. in the U.S. Pro and Advanced are the professional and advanced versions of the system, respectively. A SQL injection vulnerability exists in Six Apart MT Pro and Advanced. The vulnerability can be exploited to execute arbitrary SQ...

The vulnerability of the PHP interpreter, allowing attackers to execute XXE and XXL attacks

The vulnerability of the ext/libxml/libxml.c file in the PHP interpreter arises from the fact that, when using PHP-FPM, the isolation of individual data threads is not properly implemented. Exploiting this vulnerability allows a remote attacker to execute XXE and XXL attacks using a specially...

Framework: denial-of-service attack with XML input

A denial of service flaw was found in the way Spring processes inline DTD declarations. A remote attacker could submit a specially crafted XML file that would cause out-of-memory errors when parsed...