598 matches found
CVE-2017-11747
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a...
Default credentials
ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP's deployment of these devices...
CVE-2016-10401
ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP's deployment of these devices...
CVE-2016-10401
ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP’s deployment of these devices. Recent assessments: Assessed Attacker Value: 0 Assesse...
CVE-2017-10600
ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories...
CVE-2017-10600
ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories...
Design/Logic Flaw
ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories...
UBUNTU-CVE-2017-10600
ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories...
CVE-2017-10600
CVE-2017-10600 affects ubuntu-image 1.0 (before 2017-07-07). When run as non-root, it creates files in the resulting image with the UID of the invoking user, enabling a local attacker who shares that UID to access cloud-init and snapd directories after boot. This is a local vulnerability with pot...
openSUSE Security Update : mariadb (openSUSE-2017-644)
This update for mariadb fixes the following issues : - update to MariaDB 10.0.30 GA - notable changes : - XtraDB updated to 5.6.35-80.0 - TokuDB updated to 5.6.35-80.0 - PCRE updated to 8.40 - MDEV-11027: better InnoDB crash recovery progress reporting - MDEV-11520: improvements to how InnoDB dat...
Unauthorized Read Access
openstack-magnum is vulnerable to unauthorized read access. The vulnerability exists as the permissions for /etc/sysconfig/heat-params in openstack-magnum was 0644, which gave read access to non-root users...
Securing DNS Communication: dnscrypt-proxy
dnscrypt-proxy is a flexible DNS proxy. It runs on your computer or router, and can locally block unwanted content, reveal where your devices are silently sending data to, make applications feel faster by caching DNS responses, and improve security and confidentiality by communicating to upstream...
OracleVM 3.3 / 3.4 : sudo (OVMSA-2016-0170)
The remote OracleVM system is missing necessary patches to address critical security updates : - Update noexec syscall blacklist - Fixes CVE-2016-7032, CVE-2016-7076 Resolves: rhbz1391937 - RHEL-6.8 erratum - fixed a bug causing that non-root users can list privileges of other users Resolves:...
sudo security, bug fix, and enhancement update
1.8.6p7-20 - RHEL 7.3 erratum - fixed visudo's -q flag Resolves: rhbz1350828 1.8.6p7-19 - RHEL 7.3 erratum - removed INPUTRC from envkeep to prevent a potential info leak Resolves: rhbz1340700 1.8.6p7-18 - RHEL 7.3 erratum - removed requiretty flag from the default sudoers policy - backported...
kernel: Information leak when truncating of compressed/inlined extents on BTRFS
An information-leak vulnerability was found in the kernel when it truncated a file to a smaller size which consisted of an inline extent that was compressed. The data between the new file size and the old file size was not discarded and the number of bytes used by the inode were not correctly...
CVE-2016-6802
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path...
CVE-2016-6802
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path...
DEBIAN-CVE-2016-6802
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path...
