3849 matches found
CVE-2014-7851
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user...
Sudo sudoers plugin design vulnerability
Sudo is a suite of programs developed by software developer Todd C. Miller for Unix-like operating systems that allow users to execute commands in a secure manner with special privileges. sudoers plugin is one of the Sudo configuration plugin. A design flaw exists in the SHA-2 digest support of t...
CVE-2015-8239
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed...
Description of the security update for Word Automation Services for SharePoint Server 2010: October 10, 2017
Description of the security update for Word Automation Services for SharePoint Server 2010: October 10, 2017 Summary This security update resolves a vulnerability in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these...
Description of the security update for Outlook 2016: October 10, 2017
None None...
Description of the security update for Office 2010: July 10, 2018
Description of the security update for Office 2010: July 10, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...
CVE-2017-13721
In X.Org Server aka xserver and xorg-server before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause aborts of the X server or replace shared memory segments of other X clients in the same session...
Replacing Social Security Numbers
In the wake of the Equifax break, I've heard calls to replace Social Security numbers. Steve Bellovin explains why this is hard...
CVE-2017-14979
Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...
Code injection
Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...
CVE-2017-14979
Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...
CVE-2017-14979
Gxlcms (enterprise website creation system) is affected by CVE-2017-14979. The vulnerability arises from an unsafe character-replacement method intended to restrict access, enabling remote attackers to read arbitrary files by altering the s parameter in index.php. Affected components include Lib/...
India Goods and Services Tax Network (GSTN) Offline Utility Elevation of Privilege Vulnerability
A security vulnerability exists in GSTNofflinetool in the India Goods and Services Tax Network GSTN Offline Utility tool prior to version 1.2. A local attacker can exploit this vulnerability by replacing winstart-server.vbs with arbitrary VBScript code to gain privileges...
Description of the security update for 2007 Microsoft Office Suite: September 12, 2017 (KB3213649)
None None...
Description of the security update for Excel 2007: September 12, 2017
Description of the security update for Excel 2007: September 12, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...
Description of the Security Only update for the .NET Framework 2.0 SP2 for Windows Server 2008 SP2: September 12, 2017
Description of the Security Only update for the .NET Framework 2.0 SP2 for Windows Server 2008 SP2: September 12, 2017 View products that this article applies to. Summary This security update resolves a vulnerability in the Microsoft .NET Framework that could allow remote code execution when...
Description of the security update for Outlook 2010: September 12, 2017
Description of the security update for Outlook 2010: September 12, 2017 Summary There is a Microsoft Office update for defense-in-depth updates to help improve security-related features. To learn more about the vulnerability, see Microsoft advisory ADV170015. Note To apply this security update, y...
Description of the security update for PowerPoint Viewer 2010: September 12, 2017
Description of the security update for PowerPoint Viewer 2010: September 12, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see...
Description of the security update for Publisher 2010: September 12, 2017
Description of the security update for Publisher 2010: September 12, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Comm...