Huawei EulerOS: Security Advisory for systemd (EulerOS-SA-2019-2232)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM® Db2® LUW on AIX and Linux Affected by a Vulnerability in IBM® Spectrum Scale (CVE-2019-4558)

Summary Db2 LUW is affected by a vulnerability in IBM® Spectrum Scale Version 5.0.x and 4.2.x that is used by Db2® pureScale™ Feature on AIX and Linux. IBM Spectrum Scale is previously known as General Parallel File System GPFS. Vulnerability Details CVEID: CVE-2019-4558 DESCRIPTION: A security...

Debian DLA-2064-1 : ldm security update

It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project incorrectly parsed responses from an SSH server which could result in local root privilege escalation. For Debian 8 'Jessie', this issue has been fixed in ldm version 2:2.2.15-2+deb8u1. We...

Debian: Security Advisory (DLA-2064-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-4601-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4601-1 : ldm - security update

It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project, incorrectly parsed responses from an SSH server, which could result in local root privilege escalation. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Security Bulletin: IBM Spectrum Scale for IBM Elastic Storage Server is affected where the local attacker can obtain root privilege by injecting parameters into setuid files (CVE-2019-4558)

Summary The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale where one can obtain root privilege by injecting parameters into setuid files. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2019-4558 DESCRIPTION: A security vulnerability has be...

Siemens SPPA-T3000 MS3000 Migration Server Incorrect Access Control Vulnerability

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.MS3000 Migration Server is one of the migration servers. A security vulnerability exists in the Siemens SPPA-T3000 MS3000 Migration Server. It allows an attacker with local...

EulerOS 2.0 SP2 : rpm (EulerOS-SA-2019-2384)

According to the version of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownershi...

PT-2019-5697 · Red Hat · Cloudforms Management Engine

Name of the Vulnerable Software and Affected Versions: CloudForms Management Engine versions 5.10 through 5.11 Description: The issue is related to insufficient input validation, allowing a remote attacker to elevate privileges to root level and execute arbitrary code. An attacker logged into the...

Apple macOS 10.15.1 - Denial of Service (PoC)

Exploit Title: Apple macOS 10.15.1 - Denial of Service PoC Date: 2019-11-02 Exploit Author: 08Tc3wBB Vendor Homepage: Apple Software Link: Version: Apple macOS msghlocalport, msg1.msghsize, msg4.msghreserved, unsigned intmsg4.msghid, QWORD &msg1.msghreserved, // inputmem1 msg2.msghsize 2, //...

Apple macOS 10.15.1 - Denial of Service (PoC)

Apple macOS 10.15.1 - Denial of Service PoC Exploit Title: Apple macOS 10.15.1 - Denial of Service PoC Date: 2019-11-02 Exploit Author: 08Tc3wBB Vendor Homepage: Apple Software Link: Version: Apple macOS msghlocalport, msg1.msghsize, msg4.msghreserved, unsigned intmsg4.msghid, QWORD...

Command injection

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum3, sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The resul...

CVE-2019-15277

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE Software could allow an authenticated, local attacker to execute code with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating as the...

CVE-2019-4558

A security vulnerability has been identified in all levels of IBM Spectrum Scale V5.0.0.0 through V5.0.3.2 and IBM Spectrum Scale V4.2.0.0 through V4.2.3.17 that could allow a local attacker to obtain root privilege by injecting parameters into setuid files...

CVE-2019-4558

CVE-2019-4558 affects IBM Spectrum Scale (GPFS) across multiple lines: V5.0.0.0–V5.0.3.2 and V4.2.0.0–V4.2.3.17 permit a local attacker to obtain root privileges by injecting parameters into setuid files. IBM and vendor bulletins (Storwize V7000 Unified, Db2 LUW on AIX/Linux, Elastic Storage Serv...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where the local attacker can obtain root privilege by injecting parameters into setuid files (CVE-2019-4558)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale that could allow one to obtain root privilege by injecting parameters into setuid files. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2019-4558 DESCRIPTION: A security...

CVE-2019-12661 Cisco IOS XE Software Virtualization Manager CLI Command Injection Vulnerability

A vulnerability in a Virtualization Manager VMAN related CLI command of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root. The vulnerability is due to insufficient validation of...

CVE-2019-12661

CVE-2019-12661 : Cisco IOS XE Software’s Virtualization Manager (VMAN) CLI command is vulnerable to injection due to insufficient validation of arguments passed to a specific VMAN CLI command. An authenticated, local attacker with administrator privileges can exploit this to execute arbitrary com...

Critical Cisco VM Bug Allows Remote Takeover of Routers

A critical remote authentication-bypass vulnerability – with the highest possible severity level of 10 out of 10 on the CvSS scale – has been found in the Cisco REST API virtual service container for Cisco IOS XE Software. The bug CVE-2019-12643 affects the following hardware if running the REST...