CVE-2018-1000072: Incorrect Permission Assignment for Critical Resource

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

Code injection

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...

CVE-2017-9269

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...

CVE-2017-9269

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...

CVE-2017-9269

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...

CVE-2017-9269 lack of keypinning in libzypp could lead to repository switching

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...

CVE-2017-9269

CVE-2017-9269 affects libzypp; before Aug 2018 GPG keys attached to YUM repositories were not properly pinned, allowing malicious mirrors to downgrade to unsigned repos with potentially malicious content. The issue originates from improper key pinning rather than repository signing verification. ...

CVE-2017-9269

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...

CVE-2017-9269: Selection of Less-Secure Algorithm During Negotiation

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...

Linux Memory Cryptographic Keys Extractor: CryKeX

Some work has been already published regarding the subject of cryptograhic keys security within DRAM. Basically, we need to find something that looks like a key entropic and specific length and then confirm its nature by analyzing the memory structure around it C data types. The idea is to dump...

Virtuozzo 7 : OVMF / am_storage / anaconda / anaconda-core / etc (VZA-2017-103)

According to the version of the OVMF / amstorage / anaconda / anaconda-core / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - Downloadable ISO images of Virtuozzo as well as their MD5 and SHA256 checksums can now be verified...

Product update: Virtuozzo 7.0 Update 6 (7.0.6-635)

The Update 6 for Virtuozzo 7.0 provides new features, security fixes as well as stability and usability bug fixes. Vulnerability id: PSBM-69459 Downloadable ISO images of Virtuozzo as well as their MD5 and SHA256 checksums can now be verified against the GPG key stored at a secure location. For...

SUSE-SU-2017:2964-1 Security update for SUSE Manager Server 3.0

This update fixes the following issues: nutch: - Log Hadoop into proper log dir bsc1061574: change-default-log-location.patch salt-netapi-client: See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.13.0 spacecmd: - Configchannel export binary flag to json bsc1044719 spacewalk: - Suppo...

Parrot Security 3.9 - Security GNU/Linux Distribution Designed with Cloud Pentesting and IoT Security in Mind

Security GNU/Linux distribution designed with cloud pentesting and IoT security in mind. It includes a full portable laboratory for security and digital forensics experts, but it also includes all you need to develop your own softwares or protect your privacy with anonymity and crypto tools...

rgpg Code Injection vulnerability

The self.rungpg function in lib/rgpg/gpghelper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

GHSA-JG4M-Q6W8-VRJP rgpg Code Injection vulnerability

The self.rungpg function in lib/rgpg/gpghelper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

UCOPIA Wireless Appliance Privilege Escalation Vulnerability

Exploit for linux platform in category local exploits CVE-2017-11322 UCOPIA Wireless Appliance 5.1.8 Privileges Escalation Asset description UCOPIA solutions bring together a combination of software, appliance and cloud services serving small to large customers. More than 12,000 UCOPIA solutions...

SUSE-SU-2017:2453-1 Security update for SUSE Manager Server 3.0

This update for the SUSE Manager Server 3.0 provides several fixes and improvements. The following security issue has been fixed: spacewalk-java: - CVE-2017-7538: Do not allow HTML code injection via Cross Site Scripting XSS in the Organization Name. bsc1048968 Additionally, the following...

Security update for libzypp, zypper (important)

The Software Update Stack was updated to receive fixes and enhancements. libzypp: - Adapt to work with GnuPG 2.1.23. bsc1054088 - Support signing with subkeys. bsc1008325 - Enhance sort order for media.1/products. bsc1054671 zypper: - Also show a gpg key's subkeys. bsc1008325 - Improve signature...

openSUSE: Security Advisory for libzypp (openSUSE-SU-2017:2370-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...