Apache OpenWhisk Remote Code Execution Vulnerability (CNVD-2018-14727)

Apache OpenWhisk is an open source FaaS cloud platform from the Apache Software Foundation in the U.S. Docker Skeleton Runtime for Apache OpenWhisk is its Docker-based version. A security vulnerability exists in Docker Skeleton Runtime for Apache OpenWhisk. The vulnerability can be exploited to...

Apache OpenWhisk Remote Code Execution Vulnerability

Apache OpenWhisk is an open source FaaS cloud platform from the Apache Software Foundation in the U.S. PHP Runtime for Apache OpenWhisk is its PHP-based version. A security vulnerability exists in PHP Runtime for Apache OpenWhisk. The vulnerability can be exploited to replace the source code of a...

UBUNTU-CVE-2017-9118

PHP 7.1.5 has an Out of bounds access in phppcrereplaceimpl via a crafted pregreplace call...

GHSA-2P69-GXPM-5469 Downloads Resources over HTTP in alto-saxophone

Affected versions of alto-saxophone insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

Need to reset the SSL listener certificate on XenMobile

Need to reset the SSL listener certificate on XenMobile. Scenario : After accidentally replacing the SSL Listener certificate with another certificate, we would be unable to access the XenMobile GUI. To gain access to the XenMobile GUI to replace the SSL certificate, we need to reset the SSL...

Denial Of Service (DoS) Through Infinite Loop

keycloak-model-infinispan is vulnerable to denial of service DoS attacks through an infinite loop. The vulnerability exists due to an infinite loop that could occur during the replacement of a session where the replacement could fail, causing a DoS...

Code injection

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

Keycloak before 4.0.0.final is vulnerable to an infinite loop in session replacement, which could allow a malicious authenticated user to cause a Denial of Service on a multi-node cluster. Red Hat advisories reference CVE-2018-10912 and list a fix in later releases (e.g., Red Hat SSO 7.2.4) and a...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

GHSA-XJ3H-VC9J-J823 Directory Traversal in nodeaaaaa

Affected versions of nodeaaaaa resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Example...

CVE-2018-11756

In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-11756

In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-11757: Undefined Security Weakness

In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-10912: Loop with Unreachable Exit Condition

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

PT-2018-10178

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 4.0.0.final Description The issue is related to an infinite loop in session replacement. In a Keycloak cluster with multiple nodes, an expired session replacement could be mishandled, leading to an infinite loop. A...

Multiple Echelon Products Information Disclosure Vulnerability (CNVD-2018-18306)

Echelon SmartServer 1 and others are products of Echelon Corporation of the United States. echelon SmartServer 1 is a multifunctional controller, which supports building automation control and enterprise energy management, etc. i.LON 100 is a network server, which is mainly used to configure and...

Description of the security update for Word 2013: July 10, 2018

Description of the security update for Word 2013: July 10, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...