Kernel Security Bypass Vulnerability in Multiple Apple Products (CNVD-2018-00178)

Apple iOS, macOS High Sierra, tvOS, and watchOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices. macOS High Sierra is a specialized operating system developed for Mac computers. tvOS is a smart TV operating system. watchOS is a smart watch operating system...

Kernel Security Bypass Vulnerability in Multiple Apple Products (CNVD-2018-00177)

Apple iOS, macOS High Sierra, tvOS, and watchOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices. macOS High Sierra is a specialized operating system developed for Mac computers. tvOS is a smart TV operating system. watchOS is a smart watch operating system...

Linux Kernel Local Contention Condition Vulnerability

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A local contention condition vulnerability exists in the 'touchpmd' function of the THP implementation in Linux Kernel versions 2.6.38 through 4.14, which stems from t...

CVE-2017-1000405: Concurrent Execution using Shared Resource with Improper Synchronization

The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmdmkdirty in the touchpmd function inside the THP implementation. touchpmd can be reached by getuserpages. In such case, the pmd will become dirty. This scenario breaks the new canfollowwritepmd's logic - pmd can become dirt...

OPENSUSE-SU-2017:2984-1 Security update for redis

This update for redis to version 4.0.2 fixes the following issues: - CVE-2016-8339: CONFIG SET client-output-buffer-limit Code Execution Vulnerability boo1002351 The following upstream changes are included: - SLOWLOG now logs the offending client name and address - The modules native data types R...

CVE-2017-16633

In Joomla! before 3.8.2, a logic bug in comfields exposed read-only information about a site's custom fields to unauthorized users...

OpenSSH Design Vulnerabilities

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers maintained by the OpenBSD Project Group. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection...

HP SiteScope Information Disclosure

The vulnerability of the HP SiteScope computing resource monitoring system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating remotely with only read-only access, to view all SiteScope interfaces and “monitors,” thereby exposing...

tomcat: Remote Code Execution bypass for CVE-2017-12615

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution...

Paessler PRTG Network Monitor Elevation of Privilege Vulnerability

PRTG Network Monitor is an uptime and bandwidth monitoring software that supports various sensor types. An elevation of privilege vulnerability exists in Paessler PRTG Network Monitor 17.3.33.2830. A read-only user can create a Map by forging a request and sending it to the server...

OpenSSH < 7.6 'sftp-server' Security Bypass Vulnerability - Windows

OpenSSH is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...

CVE-2017-15917

In Paessler PRTG Network Monitor 17.3.33.2830, it's possible to create a Map as a read-only user, by forging a request and sending it to the server...

SA146: Improper User Authorization in ProxySG and ASG

SUMMARY The ProxySG and ASG management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only access can exploit this vulnerability to access management console functionality that requires read-write access privileges...

SUSE SLES12 Security Update : dracut (SUSE-SU-2017:2696-1)

This update for dracut fixes the following issues: Security issues fixed : - CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. bsc100834...

CVE-2017-14349

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

CVE-2017-14349

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

Authentication flaw

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

CVE-2017-14349: Improper Privilege Management

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

CVE-2017-14349

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

PT-2017-3008

Name of the Vulnerable Software and Affected Versions HPE SiteScope versions 11.2x through 11.3x Description The issue is related to inadequate access control in the HPE SiteScope product, allowing read-only accounts to view all SiteScope interfaces and monitors. This could potentially expose...