libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients

It was discovered that libvirtd would permit readonly clients to use the virDomainManagedSaveDefineXML API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would...

CVE-2019-10166

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local...

SUSE-SU-2019:1285-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issue fixed: - CVE-2019-3886: Fixed an information leak which allowed to retrieve the guest hostname under readonly mode bsc1131595...

DEBIAN-CVE-2019-3886

An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block...

Fedora 28 : xen (2018-a7862a75f5)

preemption checks bypassed in x86 PV MM handling XSA-264, CVE-2018-12891 1595959 x86: DB exception safety check can be triggered by a guest XSA-265, CVE-2018-12893 1595958 libxl fails to honour readonly flag on HVM emulated SCSI disks XSA-266, CVE-2018-12892 1595957 Note that Tenable Network...

CVE-2018-20193

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...

CVE-2018-20193

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...

SUSE-SU-2018:2081-2 Security update for xen

This update for xen fixes the following issues: Security issues fixed: - CVE-2018-12891: Fix preemption checks bypass in x86 PV MM handling XSA-264 bsc1097521. - CVE-2018-12892: Fix libxl failure to honour readonly flag on HVM emulated SCSI disks XSA-266 bsc1097523. - CVE-2018-12893: Fix DB...

Design/Logic Flaw

An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or in some situations users may be able to write to supposedly read-only di...

CVE-2018-12892

Concretely, CVE-2018-12892 affects Xen 4.7–4.10.x when using libxl with qemu-xen: libxl fails to pass the readonly flag to QEMU for emulated SCSI disks (disk type sd) due to an erroneous merge conflict resolution. This can allow malicious guest administrators or certain users to write to original...

Debian DSA-4236-1 : xen - security update

Multiple vulnerabilities have been discovered in the Xen hypervisor : - CVE-2018-12891 It was discovered that insufficient validation of PV MMU operations may result in denial of service. - CVE-2018-12892 It was discovered that libxl fails to honour the 'readonly' flag on HVM-emulated SCSI disks....

EulerOS 2.0 SP2 : openssh (EulerOS-SA-2018-1141)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attacker...

jbossas: Arbitrary code execution via unrestricted deserialization in ReadOnlyAccessFilter of HTTP Invoker.

It was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization. This allows an attacker to execute arbitrary code via crafted serialized data...

uktuktuk.nl XSS vulnerability

Open Bug Bounty ID: OBB-605370 Description| Value ---|--- Affected Website:| uktuktuk.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

openssh: Improper write operations in readonly mode allow for zero-length file creation

The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files...

tomcat: Remote Code Execution via JSP Upload

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution...

tomcat: Remote Code Execution bypass for CVE-2017-12615

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution...

tomcat: Remote Code Execution bypass for CVE-2017-12615

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution...

BSA-2018-538

Security Advisory ID : BSA-2018-538 Component : OpenSSH Revision : 2.0: Final The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. Affected Products Security updates have be...

tomcat: Remote Code Execution bypass for CVE-2017-12615

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution...