4342 matches found
Session Cache API - Critical - Multiple vulnerabilities - DRUPAL-SA-CONTRIB-2017-065
This module does not safely deal with serialization. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes. Versions affected Session Cache API 7.x-1.4 Drupal core is not affected. If you do not use the contributed...
baidu_analytics - Unsupported - SA-CONTRIB-2017-060
Update The maintainer has resolved this issue, please read the release notes for more information This module adds the Baidu Analytics web statistics tracking system to your website. The security team is marking this module unsupported. There is a known security issue with the module that has not...
EulerOS 2.0 SP1 : freetype (EulerOS-SA-2017-1114)
According to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1decoderparsecharstrings functi...
Cisco WebEx Extension for Chrome < 1.0.12 'atgpcext' Library GPC Sanitization RCE (cisco-sa-20170717-webex)
The Cisco WebEx Extension for Chrome installed on the remote host is a version prior to 1.0.12. It is, therefore, affected by a remote code execution vulnerability in the 'atgpcext' library due to incomplete GPC sanitization. An unauthenticated, remote attacker can exploit this, by convincing a...
Cisco WebEx Extension for Firefox < 1.0.12 'atgpcext' Library GPC Sanitization RCE (cisco-sa-20170717-webex)
The Cisco WebEx Extension for Firefox installed on the remote host is a version prior to 1.0.12. It is, therefore, affected by a remote code execution vulnerability in the 'atgpcext' library due to incomplete GPC sanitization. An unauthenticated, remote attacker can exploit this, by convincing a...
openSUSE Security Update : gnutls (openSUSE-2017-824)
This update for gnutls fixes the following issues : - GNUTLS-SA-2017-4 / CVE-2017-7507: Fix crash in status response TLS extension decoding bsc1043398 - GNUTLS-SA-2017-3 / CVE-2017-7869: Fix out-of-bounds write in OpenPGP certificate decoding bsc1034173 - Address read of 4 bytes past the end of...
Fedora 26 : drupal8 (2017-ccdf272e60)
8.3.1 - Drupal Core - Critical - Access Bypass - SA-CORE-2017-002 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...
Fedora 26 : drupal8 (2017-2df90e929a)
8.3.4 - Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-003 - 8.3.3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...
Fedora 26 : drupal8 (2017-4a981b2ded)
8.2.7 SA-CORE-2017-001 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenab...
Security update for qemu (important)
This update for qemu fixes several issues. These security issues were fixed: - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service infinite loop by leveraging an incorrect return value bsc1042159. - CVE-2017-8379: Memory leak in the keyboard input...
SUSE SLED12 / SLES12 Security Update : gnutls (SUSE-SU-2017:1838-1)
This update for gnutls fixes the following issues : - GNUTLS-SA-2017-4 / CVE-2017-7507: Fix crash in status response TLS extension decoding bsc1043398 - GNUTLS-SA-2017-3 / CVE-2017-7869: Fix out-of-bounds write in OpenPGP certificate decoding bsc1034173 - Address read of 4 bytes past the end of...
Cisco Prime Data Center Network Manager Static Credential Authentication Bypass (cisco-sa-20170607-dcnm2)
The Cisco Prime Data Center Network Manager DCNM running on the remote host is affected by an authentication bypass vulnerability due to the presence of a default user account with a static password that is not automatically removed post-installation. An unauthenticated, remote attacker can explo...
DrupalChat - Critical - Multiple vulnerabilities - SA-CONTRIB-2017-057
UPDATE 2017-07-12 : This SA originally recommended version 2.6, but it was incorrectly tagged. We've updated the SA to recommend version 2.7. Sorry for the confusion! DrupalChat allows visitors of your Drupal site to chat with each other privately or together in a public chatroom. The module did...
Fedora 24 : drupal8 (2017-3159dd230a)
8.3.4 - Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-003 - 8.3.3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...
Fedora 25 : drupal8 (2017-0d636042ef)
8.3.4 - Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-003 - 8.3.3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...
Intel Active Management Technology (AMT) Web UI Clickjacking Weakness (INTEL-SA-00081) (remote check)
The Intel Management Engine on the remote host has Active Management Technology AMT enabled, and according to its self-reported version in the banner, it is running Intel manageability firmware version 9.0.x or 9.1.x prior to 9.1.40.1000, 9.5.x prior to 9.5.60.1952, 10.0.x prior to 10.0.50.1004,...
SMTP - Moderately Critical - Information Disclosure - SA-CONTRIB-2017-055
This SMTP module enables you to send mail using a third party non-system mail service instead of the local system mailer included with Drupal. When this module is in debugging mode, it will log privileged information. CVE identifiers issued ACVE identifier will be requested, and added upon...
PECL YAML parser unsafe object handling
More info at https://www.drupal.org/SA-CORE-2017-003...
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
More info at https://www.drupal.org/SA-CORE-2017-003...
Cisco TelePresence CE and TC Software 'SIP' DoS Vulnerability (cisco-sa-20170607-tele)
Cisco TelePresence Endpoint is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...