PYSEC-2019-201

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...

RHEL 7 : kernel-rt (RHSA-2019:0514)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0514 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

The vulnerability of the Omnibox component in the Google Chrome web browser, which allows a hacker to manipulate the content of the address bar

The vulnerability of the Omnibox component in the Google Chrome web browser is related to errors in processing special characters. Exploiting this vulnerability could allow a malicious actor to manipulate the content of the address bar remotely...

UBUNTU-CVE-2018-0497

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery for a CBC based ciphersuite via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix with a wrong SHA-384 calculation for CVE-2013-0169...

CVE-2017-7470

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

Restored Linux Machine Fails to Boot

Challenge An issue with initiramfs may cause the restored Linux machine to fail to boot with the following symptoms: ForRHEL/CentOS/SUSE systems, during the boot process, they will drop into the dracut emergency shell and display errors similar to: dracut-initqueue timeout - starting timeout...

CVE-2018-0290

A vulnerability in the TCP stack of Cisco SocialMiner could allow an unauthenticated, remote attacker to cause a denial of service DoS condition in the notification system. The vulnerability is due to faulty handling of new TCP connections to the affected application. An attacker could exploit th...

ALPINE-CVE-2018-10471

An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service out-of-bounds zero write and hypervisor crash via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754...

Design/Logic Flaw

On Samsung mobile devices with N7.x software, attackers can install an arbitrary APK in the Secure Folder SD Card area because of faulty validation of a package signature and package name, aka SVE-2017-10932...

PVS Targets experience slow boot

Scenario 1 : After PVS software is upgraded ​ Provisioning Services Target Devices, that are using a BOOT.ISO to boot, experience an unusually slow boot time. The Targets can take anywhere from five to twenty minutes to boot. After the Target Device finally boots and it reaches the Windows Login...

DEBIAN-CVE-2017-15914

Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3...

Enigmail Mail Parsing Vulnerability

Enigmail is a data encryption and decryption extension for Mozilla Thunderbird and SeaMonkey web packages that provides OpenPGP's email public key encryption and signing capabilities. An email parsing vulnerability exists in versions of Enigmail prior to 1.9.9. The vulnerability arises due to an...

IBM Daeja ViewONE Arbitrary File Download Vulnerability

IBM Daeja ViewONE Virtual, Daeja ViewONE Standard, and Daeja ViewONE Professional are all products of IBM Corporation of the U.S.A. IBM Daeja ViewONE Virtual is a document viewer that supports TIFF, PDF, and Office-based documents. IBM Daeja ViewONE Virtual is a document viewer that supports TIFF...

spacewalk-backend: spacewalk-channel can be used by non-admin or disabled users for performing administrative tasks

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

DEBIAN-CVE-2016-4957

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service daemon crash via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547...

The vulnerability of the Windows operating system, which allows a malicious individual to increase their privileges

A vulnerability that allows for increased privileges exists in the Windows operating system and is related to incorrect file comparison. If exploited successfully, a malicious individual will be able to execute arbitrary code within the Local System account. They will also be able to install...

[SECURITY] [DSA 3332-2] wordpress regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3332-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 29, 2015 https://www.debian.org/security/faq -...

Android Security Restriction Bypass Vulnerability (CNVD-2015-06576)

Android is an operating system based on the Linux open kernel, announced on November 5, 2007 by Google Inc. for cell phones. A security restriction bypass vulnerability exists in LMY48I, a version of Android prior to 5.1.1. Allows an attacker to trigger a faulty process load via a crafted...

TestDisk - Partition Recovery and File Undelete for Windows, Linux and Mac

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software : certain types of viruses or human error such as accidentally deleting a Partition Table...

php: denial of service when processing a crafted file with Fileinfo

The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service application crash or possibly...