CVE-2017-18808

NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by an incorrect configuration of security settings. This is corroborated by multiple sources in the provided documents; no specific exploit, vulnerable component, root cause, or remediation guidance is detailed...

CVE-2019-15978 Cisco Data Center Network Manager Command Injection Vulnerabilities

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system OS. For more information about...

Microsoft Patches Four Publicly-Known Vulnerabilities

Microsoft patched four Windows operating system bugs – all of which are already publicly known or have proof of concept exploits – as part of its June Patch Tuesday security bulletin. Each of the vulnerabilities are rated important and there are no reports of public exploitation for the flaws. Th...

OS vulnerabilities detected in banner reporting (PCI-DSS check)

A service banner response from the remote host indicates an OS install at a level that may be vulnerable to one or more vulnerabilities. This plugin only runs when 'Check for PCI-DSS compliance' is enabled in the scan policy. It does not run if local security checks are enabled. It runs off of...

In-Spectre-Meltdown - Tool to identify Meltdown & Spectre Vulnerabilities in processors

This tool allows to check speculative execution side-channel attacks that affect many modern processors and operating systems designs. CVE-2017-5754 Meltdown and CVE-2017-5715 Spectre allows unprivileged processes to steal secrets from privileged processes. These attacks present 3 different ways ...

PT-2017-14301

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 6.1.19 Palo Alto Networks PAN-OS versions 7.0.x prior to 7.0.19 Palo Alto Networks PAN-OS versions 7.1.x prior to 7.1.14 Palo Alto Networks PAN-OS versions 8.0.x prior to 8.0.6 Description The issue...

SUSE-SU-2017:1770-1 Security update for xen

This update for xen fixes several issues. These security issues were fixed: - blkif responses leaked backend stack data, which allowed unprivileged guest to obtain sensitive information from the host or other guests XSA-216, bsc1042863 - Page transfer might have allowed PV guest to elevate...

SUSE-SU-2017:1143-1 Security update for xen

This update for xen fixes several issues. These security issues were fixed: - A malicious 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks by placing a IRET hypercall in the middle of a multicall batch XSA-21...

Information Disclosure in the Management Web Interface

A vulnerability exists in the Management Web Interface that could allow for Information Disclosure. The Management Web Interface does not properly validate specific request parameters which can potentially allow for Information Disclosure. Ref PAN-70434 / CVE-2017-7216 Successfully exploiting thi...

Local Privilege Escalation

Palo Alto Networks firewalls do not properly validate certain environment variables which can potentially allow executing code with higher privileges Ref PAN-61104/100499/CVE-2016-9151 A potential attacker with local shell access could manipulate arbitrary environment variables which could result...

NUUO NVRmini 2 3.0.8 - Multiple OS Command Injections

NUUO Multiple OS Command Injection Vulnerabilities Vendor: NUUO Inc. Product web page: http://www.nuuo.com Affected version: =3.0.8 NE-4160, NT-4040, NT-4040R DP: =04.07.0000.0030, =04.03.0000.0035 FW: =02.02.00, =1.7.0 Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS...

Unauthenticated Command Injection in Management Web Interface

Palo Alto Networks PAN-OS implements an API to enable programmatic device configuration and administration of the device. An issue was identified where the management API incorrectly parses input to a specific API call, leading to execution of arbitrary OS commands without authentication via the...

CVE-2015-3084

CVE-2015-3084 is a type-confusion vulnerability in Adobe Flash Player circa 2015. The issue allows arbitrary code execution via type-confusion in Flash’s filters (e.g., Button/MovieClip filters), with the root cause being invalid redefinition of filter constructors leading to mismatched native an...

MGASA-2014-0459 Updated kernel-tmb packages fix security vulnerabilities

This kernel-tmb update is based on upstream -longterm 3.10.58 and fixes the following security issues: The kvmiommumappages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to 1...

Verbose Error Messages

Under certain conditions, when unexpected input is provided to the web-based management UI, overly verbose error information is delivered back to the client. This does not directly result in any specific vulnerability, however this information is helpful to an attacker. Ref 33139 This issue resul...