Release Notes for Veeam Management Pack 8.0 Update 6

Challenge Release Notes for Veeam Management Pack 8.0 Update 6. NOTE : The Veeam Management Pack 8.0 Update 6 cumulative patches for Veeam Backup & Replication monitoring and VMware vSphere 7.0 monitoring are available through kb2940 and kb3172 correspondingly. Cause Please confirm you are runnin...

WhatsApp 2.18.61 Memory Corruption

!/usr/bin/env python -- coding: utf-8 -- Exploit Author: Juan Sacco at Exploit Pack- http://www.exploitpack.com This vulnerability has been discovered and exploited using ExploitPack - Framework Tested on: iPhone 5/6s/X iOS 10 and 11.4.1 Latest release of iOS at the date of writing this...

Security Bulletin: IBM® DB2® LUW on AIX and Linux Affected by vulnerabilities in zlib (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843).

Summary IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is affected by vulnerabilities in zlib. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to...

Elasticsearch ESA-2017-18

An error was found in the X-Pack Security privilege enforcement. If a user has either delete or index permissions on an index in a cluster, they may be able to issue both delete and index requests against that index. C Tenable Network Security, Inc. include"compat.inc"; if description...

Elasticsearch ESA-2017-03

When merging multiple rules with field level security rules for the same index, X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules. C Tenable Network Security, Inc. include'compat.inc'; if...

Elasticsearch ESA-2018-07

X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacker might have been able to impersonate a legitimate user if the SAML Identity Provider allows for self registration with arbitrary...

Elasticsearch ESA-2017-15

An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replaced with an instance that trusts all certificates. This could allow any node using any certificate to join a cluster. The proper behavior i...

Elasticsearch ESA-2017-19

An error was found in the permission model used by X-Pack alerting whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid112043; scriptversion"1.2";...

Elasticsearch ESA-2017-10

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated...

Elasticsearch ESA-2017-06

X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas will be...

Elasticsearch ESA-2017-09

X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias. C Tenable Netwo...

Security Bulletin: IBM® Db2® sensitive information exposure in the error log (CVE-2017-1434).

Summary When a version check to upgrade Db2 to v11.x fails, the connection string is written in the clear in an error message to db2diag.log. Vulnerability Details CVEID: CVE-2017-1434 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server under unusual circumstances, could...

Denial of Service Vulnerability in Multiple HPE Products

HPE Integrated Lights-Out, Moonshot Chassis Manager, and Moonshot Component Pack are all products of Hewlett Packard Enterprise HPE, U.S.A. HPE Integrated Lights-Out iLO is an embedded server management technology that monitors and maintains servers, controls servers remotely, and more through an...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server

Summary There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementation 1.2 is used as the default in WebSphere Application Server v7.0, other versions it is not the default. Vulnerability Detail...

Microsoft Outlook 2010 Service Pack 2 Defense in Depth Vulnerability (KB4032222)

This host is missing an important security update according to Microsoft KB4032222. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Microsoft Excel 2010 Service Pack 2 Multiple Vulnerabilities (KB4032223)

This host is missing an important security update according to Microsoft KB4032223 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Office 2010 Service Pack 2 Information Disclosure Vulnerability (KB4022198)

This host is missing an important security update according to Microsoft KB4022198 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows GDI Information Disclosure Vulnerability (CNVD-2018-17082)

Microsoft Windows 7 SP1 and others are a series of operating systems released by Microsoft.Windows Graphics Device Interface GDI is one of the graphics device interfaces. An information disclosure vulnerability exists in Microsoft Windows GDI. A remote attacker could exploit this vulnerability to...

Microsoft Outlook 2013 Service Pack 1 Defense in Depth Vulnerability (KB4032240)

This host is missing an important security update according to Microsoft KB4032240. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Microsoft Office 2013 Service Pack 1 Information Disclosure Vulnerability (KB4032239)

This host is missing an important security update according to Microsoft KB4032239 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...