tomcat: Open redirect in default servlet

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the...

CVE-2018-1439

IBM Rational Quality Manager RQM 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

tomcat: A bug in the UTF-8 decoder can lead to DoS

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86...

Apache Traffic Server Denial of Service Vulnerability (CNVD-2018-19518)

Apache Traffic Server ATS is the United States Apache Apache Software Foundation, an HTTP proxy and caching server. A security vulnerability exists in Apache ATS versions 6.0.0 through 6.2.2 and 7.0.0 through 7.1.3. An attacker could exploit the vulnerability to read an entire project from the...

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

7ghost (>=4.11.0 <=4.11.46), @igames/ghost (>=3.41.6 <=4.0.0-alpha.2) +20 more potentially affected by CVE-2018-3773 via metascraper (>=1.0.7 <=5.29.8)

metascraper NPM version =1.0.7, =4.11.0, =3.41.6, =1.0.0, =1.1.0, =1.0.0, =2.0.0, =3.9.0, =3.17.1, =1.0.0, =1.0.3 and more Source cves: CVE-2018-3773 Source advisory: OSV:GHSA-8F64-Q7JC-CCGP...

Raccoon - A High Performance Offensive Security Tool For Reconnaissance And Vulnerability Scanning

Offensive Security Tool for Reconnaissance and Information Gathering. Features DNS details DNS visual mapping using DNS dumpster WHOIS information TLS Data - supported ciphers, TLS versions, certificate details and SANs Port Scan Services and scripts scan URL fuzzing and dir/file detection...

UBUNTU-CVE-2018-14339

In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by adding offset and length validation...

PT-2018-12295 · Twitter +4 · Bootstrap +4

Name of the Vulnerable Software and Affected Versions: Bootstrap versions 2.3.0 through 3.4.0 Bootstrap versions 4.0.0 through 4.1.1 Description: The issue allows for XSS in the collapse data-parent attribute. Recommendations: For Bootstrap versions 2.3.0 through 3.4.0, update to version 3.4.0 or...

tomcat: A bug in the UTF-8 decoder can lead to DoS

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86...

McAfee ePolicy Orchestrator Information Disclosure Vulnerability (CNVD-2018-14365)

McAfee ePolicy Orchestrator ePO is a suite of scalable security management software from McAfee. The software enables centralized, streamlined management of endpoint, network, content security and compliance solutions. An information disclosure vulnerability exists in McAfee ePO versions 5.3.0...

Remote Code Execution (RCE)

libxml2.so is vulnerable to remote code execution RCE attacks. The application does not forbid namespace nodes in XPointer ranges, allowing a malicious user to inject and execute arbitrary code...

Ubuntu 17.10 : DPDK vulnerability (USN-3642-2)

USN-3642-1 fixed a vulnerability in DPDK. This update provides the corresponding update for Ubuntu 17.10. Maxime Coquelin discovered that DPDK incorrectly handled guest physical ranges. A malicious guest could use this issue to possibly access sensitive information. Note that Tenable Network...

USN-3642-2: DPDK vulnerability

USN-3642-1 fixed a vulnerability in DPDK. This update provides the corresponding update for Ubuntu 17.10. Original advisory details: Maxime Coquelin discovered that DPDK incorrectly handled guest physical ranges. A malicious guest could use this issue to possibly access sensitive information...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4108)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4108 advisory. - netfilter: nfnetlinkcthelper: Add missing permission checks Kevin Cernekee Orabug: 27260771 CVE-2017-17448 - netlink: Add netns check on taps Kev...

Ubuntu 18.04 LTS : DPDK vulnerability (USN-3642-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3642-1 advisory. Maxime Coquelin discovered that DPDK incorrectly handled guest physical ranges. A malicious guest could use this issue to possibly access sensitive information...

USN-3642-1 dpdk vulnerability

Maxime Coquelin discovered that DPDK incorrectly handled guest physical ranges. A malicious guest could use this issue to possibly access sensitive information...

USN-3642-1: DPDK vulnerability

Maxime Coquelin discovered that DPDK incorrectly handled guest physical ranges. A malicious guest could use this issue to possibly access sensitive information...

DEBIAN-CVE-2018-1059

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions...

UBUNTU-CVE-2018-1059

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions...