4342 matches found
Nextcloud Server < 14.0.0, < 13.0.3, < 12.0.8 Session fixation on public share page (NC-SA-2018-013) - Windows
Nextcloud Server is prone to a session fixation vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Nextcloud Server < 14.0.0 Multiple Vulnerabilities (NC-SA-2018-011, NC-SA-2018-012, NC-SA-2018-014) - Windows
Nextcloud Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Session Limit - Critical - Insecure Session Management - SA-CONTRIB-2018-072
The session limit module enables a site administrator to set a policy around the number of active sessions users of the site may have. This is typically set to one so that you can only be logged in once with the same user account. In one configuration of the module, when a user logs in with anoth...
EulerOS Virtualization 2.5.0 : gnupg2 (EulerOS-SA-2018-1333)
According to the version of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A data validation flaw was found in the way gnupg processes file names during decryption and signature validation. An attacker may be...
Intel Quartus Family - Privilege Escalation Vulnerability
Document Title: =============== Intel Quartus Family - Privilege Escalation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2160 Video: https://www.vulnerability-lab.com/getcontent.php?id=2159 Intel ID: INTEL-SA-00151 Ref:...
Drupal 7.x < 7.60 / 8.5.x < 8.5.8 / 8.6.x < 8.6.2 Drupal Multiple Vulnerabilities (SA-CORE-2018-006)
According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.60, 8.5.x prior to 8.5.8, or 8.6.x prior to 8.6.2. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
Drupal Core Multiple Security Vulnerabilities (SA-CORE-2018-006) - Windows
Drupal is prone to multiple security vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Search Autocomplete - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-070
This Search Autocomplete module enables you to autocomplete textfield using data from your website nodes, comments, etc... The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting XSS vulnerability. This vulnerability can be exploit...
HTML Mail - Critical - Remote Code Execution - SA-CONTRIB-2018-069
The HTML Mail module lets you theme your messages the same way you theme the rest of your website. When sending email some variables were not being sanitized for shell arguments, which could lead to remote code execution. This issue is related to the Drupal Core release SA-CORE-2018-006...
Workbench Moderation - Moderately critical - Access bypass - SA-CONTRIB-2018-067
The Workbench Moderation module adds arbitrary moderation states to Drupal core's "unpublished" and "published" node states, and affects the behavior of node revisions when nodes are published. In some conditions, content moderation fails to check a users access to use certain transitions, leadin...
Cisco Prime Infrastructure TFTP Arbitrary File Upload and Command Execution Vulnerability (cisco-sa-20181003-pi-tftp)
The Cisco Prime Infrastructure application running on the remote host is affected by an arbitrary file upload flaw, which could lead to a remote code execution vulnerability. This is due to incorrect permissions for various system folders, which a file could be uploaded to via TFTP. The commands ...
NVP field - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-066
NVP field module allows you to create a field type of name/value pairs, with custom titles and easily editable rendering with customizable HTML/text surrounding the pairs. The module doesn't sufficiently handle sanitization of its field formatter's output. This vulnerability is mitigated by the...
Cisco IOS Software IPv6 Hop-by-Hop DoS Vulnerability (cisco-sa-20180926-ipv6hbh)
According to its self-reported version, the IOS is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...
The vulnerability of the Intel-SA-00086 Detection Tool arises from privilege management errors, allowing a perpetrator to execute arbitrary code.
The vulnerability of the Intel-SA-00086 Detection Tool arises from privilege management errors. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Cisco IOS XE Software OSPFv3 DoS Vulnerability (cisco-sa-20180926-ospfv3-dos)
According to its self-reported version, the IOS XE is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...
Printer, email and PDF versions - Highly critical - Remote Code Execution - SA-CONTRIB-2018-063
This module provides printer-friendly versions of content, including send by e-mail and PDF versions. The module doesn't sufficiently sanitize the arguments passed to the wkhtmltopdf executable, allowing a remote attacker to execute arbitrary shell commands. It also doesn't sufficiently sanitize...
Commerce Klarna Checkout - Moderately critical - Access bypass - SA-CONTRIB-2018-062
The Commerce Klarna Checkout module enables you to accept payments from the Klarna Checkout payment provider The module doesn't sufficiently validate the payment callback made by Klarna. An attacker could bypass the payment step...
Renderkit - Moderately critical - Access bypass - SA-CONTRIB-2018-060
This module, typically in combination with cfr:cfrplugin, allows to compose behaviors from granular components. One of such behaviors is to display a list of related entities, for a given source entity and a given entity relation e.g. an entity reference field. The components that display related...
[SECURITY] [DLA 1506-1] intel-microcode security update
Package : intel-microcode Version : 3.20180807a.1deb8u1 CVE ID : CVE-2018-3615, CVE-2018-3620, CVE-2018-3646 CVE-2018-3639, CVE-2018-3640, CVE-2017-5715 Security researchers identified speculative execution side-channel methods which have the potential to improperly gather sensitive data from...
