qemu -- denial of service vulnerability in USB EHCI emulation support

Prasad J Pandit, Red Hat Product Security Team, reports: Qemu emulator built with the USB EHCI emulation support is vulnerable to an infinite loop issue. It occurs during communication between host controller interfaceEHCI and a respective device driver. These two communicate via a isochronous...

OpenMRS 2.3 (1.11.4) - 文件泄漏漏洞

No description provided by source. OpenMRS 2.3 1.11.4 Local File Disclosure Vulnerability Vendor: OpenMRS Inc. Product web page: http://www.openmrs.org Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 Platform 1.11.4 Build 6ebcaf, 1.11.2 and 1.10.0 OpenMRS-TB System OpenMRS 1.9.7 Build 60bd9b Summary...

Directory traversal

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/...

Cisco Virtual Topology System TCP Connection Functionality Denial of Service Vulnerability

A vulnerability in TCP connection handling by Cisco Virtual Topology System VTS devices could allow an unauthenticated, remote attacker to disable TCP ports and cause a denial of service DoS condition due to high CPU and memory utilization. The vulnerability is due to a lack of rate limiting in t...

net-snmp security and bug fix update

1:5.7.2-24 - Fixed lmSensorsTable not reporting sensors with duplicate names 1252053 - Fixed close overhead of extend commands 1252048 - Fixed out-of-bounds write in python code 1252034 1:5.7.2-23 - Fixed parsing of invalid variables in incoming packets 1248414 - Fixed...

Vulnerability of Firefox and Firefox ESR browsers, which allows attackers to circumvent existing access restrictions

The vulnerability of Firefox and Firefox ESR browsers is related to the improper use of shared resources between different sources. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions by avoiding the check-step during requests...

Moderate: Red Hat Security Advisory: file security and bug fix update

Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings,...

QEMU hw/virtio/virtio.c Denial of Service Vulnerability

QEMU is an open source emulator software. With virtio-net support enabled in QEMU, a security vulnerability in the hw/virtio/virtio.c handling could allow a remote attacker to exhaust client network resources, resulting in a denial of service...

How to Add SQL Database Connections to XenMobile Server

This article describes how to add / increase additional SQL database connections from XenMobile. By default XenMobile Server 10.x has 50 database connections to SQL database. Note: Please be sure that your SQL Server has enough resources RAM & CPU to handle the additional load on the server prior...

Shopify: SVG parser loads external resources on image upload

Uploading SVG that include will cause the server side parser to try to fetch external resources. I've tested in two ways. Creating an svg with an external loaded public google image that was rendered perfectly. Also tested a private server with nc and created an svg that uses xlink for private ur...

CVE-2007-1581

The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hashupdatefile function via a userspace 1 error or 2 stream handler, which can then be used to destroy and modify internal resources. NOTE: it was later reported that PH...

CVE-2011-0528

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors...

Unspecified Vulnerability in Oracle PeopleSoft Products (CNVD-2015-06956)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle. An unspecified vulnerability exists in Oracle PeopleSoft Products 9.2. It allows a remote, authenticated user to affect confidentiality via vector fin resources related to management security...

The vulnerability of the Firefox browser, which allows a hacker to execute arbitrary code or trigger a service failure.

The vulnerability of the WorkerPrivate::NotifyFeatures function in the Firefox browser is caused by synchronization errors when using a shared resource. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure due to errors in the implementation ...

The vulnerability of the Microsoft .NET Framework software allows a hacker to cause a service failure for a web resource based on ASP.NET.

The vulnerability of the Microsoft .NET Framework software platform is related to errors in the code. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause a service failure for a web resource based on ASP.NET, using a specially crafted request...

Cisco ASR 1000 Series Router Segmented IPv4 Processing Denial of Service Vulnerability

The Cisco ASR1000 Series Aggregation Services Routers provide a WAN edge solution that integrates information, communication, collaboration, and commerce. A security vulnerability in the Cisco ASR 1000 Series Router's processing of 100,000 segmented IPv4 messages allows a remote attacker to explo...

Generalized SQL Injection Vulnerability in Human Resources and Social Security System of Zhejiang Netnew Enpro Software Co.

Zhejiang Netnew Enpro Software Co., Ltd. is an enterprise dedicated to informatization construction and service of human resources social security and e-government industry. The human resources and social security system is one of the company's application systems. A generic SQL injection...

Red Hat PicketLink Privilege Bypass Vulnerability

Red Hat PicketLink is a unified identity management framework for Java applications. The 'invokeNextValve' function in the identity/federation/bindings/tomcat/idp/AbstractIDPValve.java file of Red Hat PicketLink failed to correctly Checking role-based authorization allows remote attackers to send...

CVE-2015-3158

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

Authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...