CVE-2017-5200: Undefined Security Weakness

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's sshclient...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry function in XRef.cc via a crafted PDF document. Remediation A fix was pushed into the master branch but not yet published. References...

Milwaukee ONE-KEY Android mobile application trust management vulnerability

Milwaukee ONE-KEY Android mobile application is an automation tool control program based on the Android platform from Milwaukee Tool. A security vulnerability exists in the Milwaukee ONE-KEY Android mobile application, which originates from the program storing the master token in plaintext in the...

OpenJPEG - mqc.c Heap-Based Buffer Overflow Exploit

Exploit for linux platform in category dos / poc DESCRIPTION An Out-of-Bounds Write issue can be occurred in function opjmqcbyteout of mqc.c during executing opjcompress. This issue was caused by a malformed BMP file. CREDIT This vulnerability was discovered by Ke Liu of Tencent's Xuanwu LAB...

OpenJPEG - mqc.c Heap Buffer Overflow

OpenJPEG - mqc.c Heap Buffer Overflow DESCRIPTION An Out-of-Bounds Write issue can be occurred in function opjmqcbyteout of mqc.c during executing opjcompress. This issue was caused by a malformed BMP file. CREDIT This vulnerability was discovered by Ke Liu of Tencent's Xuanwu LAB. TESTED VERSION...

Ransomware Roundup: Attacking the Master Boot Record Featuring Petya

Ransomware is innovating to spread faster, hit harder and increase its payout potential. New, unknown variants pop up daily, and many leverage non-malware techniques to evade traditional defenses. Petya is a perfect example of how modern ransomware is evolving, using new techniques to attack the...

CVE-2017-1489

IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an e-community domain. IBM X-Force ID: 128687...

CVE-2017-1489

IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an e-community domain. IBM X-Force ID: 128687...

CVE-2017-1489: URL Redirection to Untrusted Site

IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an e-community domain. IBM X-Force ID: 128687...

CVE-2017-1489

IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an e-community domain. IBM X-Force ID: 128687...

PT-2017-13738

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager versions 6.1 through 9.0 Description The issue allows ECSSO Master Authentication to redirect to a server not participating in an e-community domain, potentially affecting e-community configurations. Recommendations...

CVE-2017-12791

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

UBUNTU-CVE-2017-12791

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

PYSEC-2017-151

Withdrawn as duplicate of PYSEC-2017-35 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

CVE-2017-12791

CVE-2017-12791 is a SaltStack directory traversal vulnerability in minion ID validation. The issue affects Salt before 2016.11.7 and 2017.7.x before 2017.7.1, allowing remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. The vulnerability stems from insuf...

SUSE SLED12 Security Update : puppet (SUSE-SU-2017:2113-1)

This update for puppet fixes the following issues: Security issue fixed : - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as...

IBM InfoSphere Master Data Management Server Cross-Site Scripting Vulnerability

IBM InfoSphere Master Data Management MDM Server is an American IBM solution for helping organizations manage enterprise-wide master data information about customers, suppliers, products, and accounts. A cross-site scripting vulnerability exists in IBM InfoSphere Master Data Management Server. A...

How to Update Machine Catalog to propagate changes applied to the Master Image

By following the steps provided in this article you will be able to apply changes to the Master Image and propagate those changes to the machines in the Machine Catalogs in question...

PT-2017-12323

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Master Data Management Server versions 10.0 through 11.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

CVE-2017-1199: Improper Neutralization of Input During Web Page Generation

IBM InfoSphere Master Data Management Server 10.0, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within...