Design/Logic Flaw

Vulnerability in the Hospitality Property Interfaces component of Oracle Hospitality Applications subcomponent: Parser. The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality Property...

CVE-2017-10144

Vulnerability CVE-2017-10144 affects Oracle E-Business Suite, Oracle Applications Manager (subcomponent Oracle Diagnostics Interfaces). The affected version is 12.1.3. An unauthenticated attacker who can reach Oracle Applications Manager over HTTP can compromise it, with the impact described as a...

CVE-2017-10216

Vulnerability in the Hospitality Property Interfaces component of Oracle Hospitality Applications subcomponent: Parser. The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality Property...

CVE-2017-10220

CVE-2017-10220 affects Oracle Hospitality Applications, Hospitality Property Interfaces Parser (v8.10.x). A local, unauthenticated attacker with logon can access and read data via the Parser, causing confidentiality impact (CVSSv3 base 4.0). No exploitation details are provided in the documents; ...

CVE-2017-10144: Undefined Security Weakness

Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite subcomponent: Oracle Diagnostics Interfaces. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

PT-2017-11208

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Applications version 8.10.x Description The issue affects the Hospitality Property Interfaces component, specifically the Parser subcomponent. It allows a low-privileged attacker with network access via HTTP to compromise...

PT-2017-11212

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Applications version 8.10.x Description The issue affects the Hospitality Property Interfaces component, specifically the Parser subcomponent. It allows an unauthenticated attacker with logon access to the infrastructure to...

PT-2017-11137

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite version 12.1.3 Description The issue affects the Oracle Applications Manager component, specifically the Oracle Diagnostics Interfaces subcomponent. It allows an unauthenticated attacker with network access via HTTP to...

CVE-2017-10220: Undefined Security Weakness

Vulnerability in the Hospitality Property Interfaces component of Oracle Hospitality Applications subcomponent: Parser. The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Hospitality Property...

CVE-2017-10216: Undefined Security Weakness

Vulnerability in the Hospitality Property Interfaces component of Oracle Hospitality Applications subcomponent: Parser. The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality Property...

Moderate: Red Hat Bug Fix Advisory: GTK+ bug fix update

An update for GTK+ is now available for Red Hat Enterprise Linux 7. The GTK+ packages contain the GIMP ToolKit GTK+, a library for creating graphical user interfaces for the X Window System. For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes...

Oracle E-Business Suite Denial of Service Vulnerability

Oracle E-Business Suite E-Business Suite is a set of Oracle's fully integrated global business management software. Oracle Applications Manager is one of the components used to monitor the performance and availability of the Oracle Application Server. A security vulnerability exists in the Oracle...

OpenJDK: Nashorn incompletely blocking access to Java APIs (Scripting, 8171539)

It was discovered that the Nashorn JavaScript engine in the Scripting component of OpenJDK could allow scripts to access Java APIs even when access to Java APIs was disabled. An untrusted JavaScript executed by Nashorn could use this flaw to bypass intended restrictions...

Password Masking

Slashdot asks if password masking -- replacing password characters with asterisks as you type them -- is on the way out. I don't know if that's true, but I would be happy to see it go. Shoulder surfing, the threat is defends against, is largely nonexistent. And it is becoming harder to type in...

Virtuozzo 7 : readykernel-patch (VZA-2017-057)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - A vulnerability was found in the implementation of vxlan interfaces in the Linux kernel. A privileged user inside a...

Virtuozzo 7 : readykernel-patch (VZA-2017-058)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the implementation of vxlan interfaces in the Linux kernel. A privileged user inside a...

Kernel security update: Virtuozzo ReadyKernel patch 24.0 for Virtuozzo 7.0.4 HF3

The first Virtuozzo ReadyKernel patch for Virtuozzo kernel 3.10.0-514.16.1.vz7.30.15 Virtuozzo 7.0.4 HF3. This patch introduces a security fix and stability bug fixes. Vulnerability id: PSBM-67263 A vulnerability was found in the implementation of vxlan interfaces in the Linux kernel. A privilege...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Cross-Site Scripting Vulnerabilities

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network Manager EPNM are both products of the U.S. Cisco Cisco.PI is a set of solutions for wireless management through Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technologies; EPNM is a network...

rhosp-director: libvirtd is deployed with no authentication

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...

rhosp-director: libvirtd is deployed with no authentication

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...