PYSEC-2018-72

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

CVE-2017-1000483

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

PYSEC-2018-70

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

CVE-2017-1000481

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

PYSEC-2018-72

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

CVE-2017-1000481

The CVE-2017-1000481 issue affects Plone 2.5–5.1rc1 where a login flow uses a came_from parameter to redirect after login. A malformed/crafted link can lead users to an attacker’s site or allow attacker-controlled JavaScript execution; Plone’s isURLInPortal checks mitigate, but additional bypasse...

On servers after installing the hotfix XA650R07W2K8R2X64017 the IMA service won't start.

On several servers after installing the hotfix XA650R07W2K8R2X64017 the IMA service won't start anymore although no error was returned during Hotfix installation. In the IMA Runtime registry, the Currently Loading Plugin will have MfSrvss.dll. Moreover, when checking the Certificate settings for...

Product update: Virtuozzo 7.0 Update 6 Hotfix 2 (7.0.6-695)

The Hotfix 2 for Virtuozzo 7.0 Update 6 provides a new feature as well as stability and usability bug fixes. Vulnerability id: PSBM-65549 Resource alerts could be shown in Virtuozzo Automator for Windows VMs with enough resources. Vulnerability id: PSBM-78460 Container live migration could fail d...

Product update: Virtuozzo Automator 7.0 Update 2 Hotfix 4 (VA MN: 7.0.2-545, VA Agent: 7.0.2-278)

This hotfix for Virtuozzo Automator 7.0.2 provides new features as well as stability and usability bug fixes. Vulnerability id: PVA-35054 VM could not be shown in the Control Center. Vulnerability id: PVA-37072 XML API returned empty list of VM templates after restart of the prl-disp service...

Citrix XenServer Security Update (CTX230624)

A security issue has been identified within Citrix XenServer that may allow the malicious administrator of a guest VM to cause the host to crash. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2017-3195

Commvault Edge Communication Service cvd prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges...

Citrix XenServer Multiple Vulnerabilities (CTX230138)

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities as noted in the CTX230138 advisory. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid105083; scriptversion"1.10";...

TeamViewer Rushes Fix for Permissions Bug

Remote support software company TeamViewer said Tuesday it issued a hotfix for a bug that allows users sharing a desktop session to gain control of the other’s computer without permission. The bug was first publicized by a Reddit user “xpl0yt” on Monday who linked to a proof-of-concept example of...

Citrix XenServer Multiple Security Updates (CTX230138)

A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of an HVM guest VM to compromise the host. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by t...

Product update: Virtuozzo 7.0 Update 6 Hotfix 1 (7.0.6-678)

The Hotfix 1 for Virtuozzo 7.0 Update 6 provides stability and usability bug fixes. Vulnerability id: PSBM-72443 Migration of a VM with two HDDs from Virtuozzo 6 to 7 could fail due to a libvirt conversion failure. Vulnerability id: PSBM-77096 vstorage-mount could crash under certain conditions d...

Check Point Gaia Operating Security and Stability Update (sk100431)

The remote host is running a version of Gaia OS which is affected by an issue where system stability may be affected by certain traffic conditions. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid104996; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date: 2017/12/04...

Check Point Gaia Operating Bash Code Injection (sk102673)(SHELLSHOCK)

The remote host is running a version of Gaia OS which is affected by issues related to the SHELLSHOCK set of vulnerabilities in bash. An error in the bash functionality that evaluates specially formatted environment variables passed to it from another environment, which may result in remote code...

SolarWinds Orion NPM 12.0.15300.90 Multiple Vulnerabilities

SolarWinds Orion NPM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Product update: Virtuozzo PowerPanel RTM Hotfix 4 (7.0.1-422)

The new packages for Virtuozzo PowerPanel introduce a new feature as well as usability fixes. Vulnerability id: PP-336 Unable to select key combinations from the "Send Key Combination" list when using Mozilla Firefox. Vulnerability id: PP-506 Update could fail due to a package repository conflict...

Intel Unite® App denial of service and information disclosure vulnerability

Summary: Vulnerability in Admin portal for Intel Unite ® App allows a remote attacker to cause information disclosure and/or denial of service. Description: A privilege escalation vulnerability was found, which allows an attacker with network access to gain access to the admin portal, which could...