Heap overflow

A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target in order to exploit this...

CVE-2020-28575

CVE-2020-28575 concerns Trend Micro ServerProtect for Linux 3.0. A heap-based buffer overflow in the Kernel Hook Module (KHM) used by ServerProtect allows local privilege escalation when an attacker can execute high-privileged code. The root cause is improper handling/validation of data length in...

CVE-2020-24561

A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attacker must first obtain admin/root privileges on the SPLX console to exploit this vulnerability...

Photon OS 3.0: Sqlite PHSA-2020-3.0-0113

An update of the sqlite package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0113. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid13852...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the 1 S44, 2 S5, 3 Sactionfail, 4 Sptnupdate, 5 T113, 6 T114, 7 T115, 8 T117117, 9 T118, 10 Tactionfail, 11 Tptnupdate, 12...

CVE-2017-9033

Cross-site request forgery CSRF vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoptionset.cgi, related to the...

CVE-2017-9037

CVE-2017-9037 affects Trend Micro ServerProtect for Linux 3.0 prior to CP 1531. The advisory/related reports document cross-site scripting vulnerabilities in notification.cgi and related CGI scripts, enabling an attacker to inject arbitrary script/HTML via parameters such as S44, S5, S_action_fai...

CVE-2017-9033

Cross-site request forgery CSRF vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoptionset.cgi, related to the...

CVE-2017-9037

Multiple cross-site scripting XSS vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the 1 S44, 2 S5, 3 Sactionfail, 4 Sptnupdate, 5 T113, 6 T114, 7 T115, 8 T117117, 9 T118, 10 Tactionfail, 11 Tptnupdate, 12...

CVE-2017-9032

CVE-2017-9032 affects Trend Micro ServerProtect for Linux 3.0 prior to CP 1531. The vulnerability is a cross-site scripting flaw in the web interface’s log_management.cgi, where the T1 and tmLastConfigFileModifiedDate parameters can be abused to inject arbitrary script/HTML. Evidence in connected...

Abuse 2.0 - Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6094/info Vulnerabilities have been discovered in two files used by Abuse. By passing an execessively long commandline argument to Abuse, it is possible to overrun a buffer. Exploiting this issue could allow a local...

Actualizer CMS - Multiple Vulnerabilities

Cross Site Scripting, Blind SQL Injection and Full Path Disclosure that i found on Actualizer CMS. Title: Actualizer CMS - Multiple Vulnerabilities Date: 22.09.2013 Tested on: Linux 3.0 - 3.9 95% Vendor: actualizer.pl Demo: demo.actualizer.pl Dork: intext:"Powered by Actualizer & Heuristic"...

Fedora 14 : java-1.6.0-openjdk-1.6.0.0-54.1.9.9.fc14 (2011-9523)

PR744: icedtea6-1.10.2 : patching error - PR748: Icedtea6 fails to build with Linux 3.0. - RH718164, CVE-2011-2513: Home directory path disclosure to untrusted applications Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...

Expat 2.0.1 - UTF-8 Character XML Parsing Remote Denial of Service

Bugtraq ID: 36097 Class: Input Validation Error Published: Jan 17 2009 12:00AM Updated: Nov 12 2009 08:06PM Credit: Peter Valchev Vulnerable: SuSE openSUSE 11.0 SuSE openSUSE 10.3 SuSE Linux 9 SuSE Linux 11 SuSE Linux 10.0 RedHat Fedora 11 RedHat Fedora 10 RedHat Enterprise Linux WS 4 RedHat...

CUPS '_cupsImageReadTIFF()'整数溢出漏洞

BUGTRAQ ID: 34571 CVE ID：CVE-2009-0163 CNCVE ID：CNCVE-20090163 Common Unix Printing SystemCUPS是一款通用Unix打印系统，是Unix环境下的跨平台打印解决方案，基于Internet打印协议，提供大多数PostScript和raster打印机服务。 CUPS处理TIFF图像存在整数溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。...

Debian Security Advisory DSA 212-1 (mysql)

The remote host is missing an update to mysql announced via advisory DSA 212-1. OpenVAS Vulnerability Test $Id: deb2121.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 212-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

PHP EXT/Session HTTP应答头注入漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP的ext/session在置于会话COOKIE前没有URL编码会话ID，远程攻击者可以利用漏洞可以对会话COOKIE进行注入攻击。 当PHP' ext/session调用sessionstart，会在部分情况下发送新会话COOKIE，这些情况如下： - session id嵌入到PATHINFO - session id重生成 - session id通过sessionid设置 - sessionstart多次调用...

Yukihiro Matsumoto Ruby CGI.RB库拒绝服务漏洞

Yukihiro Matsumoto Ruby是一种解释型的方便快捷的面向对象脚本语言。 Yukihiro Matsumoto Ruby cgi.rb的CGI库存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 提交特殊的HTTP请求到任意使用cgi.rb的WEB应用程序，可导致消耗大量CPU而造成停止响应，产生拒绝服务攻击。 Yukihiro Matsumoto Ruby 1.8.5 Yukihiro Matsumoto Ruby 1.8.4 Yukihiro Matsumoto Ruby 1.8.3 Yukihiro Matsumoto Ruby 1.8.2 pre4 +...

[SECURITY] [DSA 1101-1] New courier packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1101-1 [email protected] http://www.debian.org/security/ Martin Schulze June 23rd, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1077-1] New lynx-ssl packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1077-1 [email protected] http://www.debian.org/security/ Martin Schulze May 26th, 2006 http://www.debian.org/security/faq -...