Move sensitive information out of Synchrony JVM arguments

h3. Issue Running Synchrony as a stand-alone service for data center instances exposes sensitive information such as the database username/password, and public/private keys. These are all passed as JVM arguments. This means anyone with command-line access to the server can see this information vi...

Move sensitive information out of Synchrony JVM arguments

h3. Issue Running Synchrony as a stand-alone service for data center instances exposes sensitive information such as the database username/password, and public/private keys. These are all passed as JVM arguments. This means anyone with command-line access to the server can see this information vi...

gdm: Crash when holding Escape in log screen

It was found that gdm could crash due to a signal handler dispatched to an invalid conversation. An attacker could crash gdm by holding the escape key when the screen is locked, possibly bypassing the locked screen...

Kernel: fs: umount denial of service

The doumount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAPSYSADMIN capability for doremountsb calls that change the root filesystem to read-only, which allows local users to cause a denial of service loss of writability by making certain unshare system calls...

Apple iOS Notifications Information Disclosure Vulnerability

Apple iOS is an operating system developed by Apple for mobile devices, and Notifications is one of the notification components. An information disclosure vulnerability exists in the Notifications component in Apple iOS versions prior to 10.3.3. When the Notifications feature is disabled, an...

CVE-2017-10604 Junos OS: SRX Series: Cluster configuration sync failures occur if the root user account is locked out

When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect password can trigger a lockout of the root account. When an SRX Series device is in cluster mode, and a cluster sync or failover operatio...

Users get multiple OTP Push Notifications, Radius servers see multiple Auth requests & Auth Failures

Users will receive authentication denials, may receive multiple Push Notifications, Radius servers will log multiple simultaneous authentication requests for the same user with different Radius IDs, or user One Time Password tokens will become locked out. If you review traces, you will see multip...

CVE-2017-5625

In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition except 'keystore' by issuing the 'fastboot oem dump ' fastboot command...

UBUNTU-CVE-2016-3729

The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator...

CVE-2016-3729

The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator...

CVE-2017-2385

An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "Safari Login AutoFill" component. It allows local users to obtain access to locked keychain items via unspecified vectors...

Apple iOS Accounts Component Authentication Prompt Vulnerability

Apple iOS is an operating system developed by Apple Inc. for mobile devices, and Accounts is one of the user account components. A security vulnerability exists in the Accounts component of Apple iOS versions prior to 10.3. The vulnerability can be exploited by an attacker to view an Apple ID fro...

Virtuozzo 7 : vmauth (VZA-2017-018)

According to the version of the vmauth package installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - Incorrect checking of locked VM accounts in Virtuozzo SDK allowed one to use any password to log in to a VM with such a locked account via a...

Citrix Receiver: Difference of Logon Experience When Logon StoreFront with a Locked Account by Using Username/password and Smart Card

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information This article describes user experience of using Pass-throughwith username and password or smart card log...

Product security update: Virtuozzo 7.0 Update 3 Hotfix 2 (7.0.3-640)

The new package for Virtuozzo 7.0.3 introducing a security fix. Vulnerability id: PSBM-62160 Incorrect checking of locked VM accounts in Virtuozzo SDK allowed one to use any password to log in to a VM with such a locked account via a third-party program using Virtuozzo SDK that was launched on...

Apple iOS WiFi Security Bypass Vulnerability

Apple iOS is an operating system developed by Apple Inc. for mobile devices. A security vulnerability exists in the WiFi component of Apple iOS, which allows a local attacker to take control of a device that is in an active-locked state and briefly display the home screen...

Information Disclosure

bepasty is vulnerable to information disclosure. A user that's not an admin can access the metadata of locked files...

Google Android Local Elevation of Privilege Vulnerability (CNVD-2016-07413)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A local elevation of privilege vulnerability exists in System UI Tuner in Android version 7.0. A local attacker can exploit this vulnerability to modify the protection settings of...

Linux Kernel 'ovl_copy_up_locked()' Local Denial of Service Vulnerability

Linux kernel is an open source operating system. Linux Kernel 'ovlcopyuplocked' local denial of service vulnerability allows local attackers to cause a denial of service by exploiting this vulnerability...

CVE-2016-3838

Android 6.x before 2016-08-01 allows attackers to cause a denial of service loss of locked-screen 911 functionality via a crafted application that uses the app-pinning feature, aka internal bug 28761672...