OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)

It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with...

CVE-2017-12631

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

Cross site request forgery (csrf)

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

CVE-2017-12631

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

CVE-2017-12631

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

CVE-2017-12631

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

PT-2017-12612

Name of the Vulnerable Software and Affected Versions Apache CXF Fediz versions prior to 1.4.3 Apache CXF Fediz versions prior to 1.3.3 Description A CSRF style vulnerability has been found in the Spring 2, Spring 3, and Spring 4 plugins. This issue can result in a security context that is set up...

CVE-2017-12631: Cross-Site Request Forgery (CSRF)

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

FortiOS Reflected XSS in Web Proxy Disclaimer Response web page

A reflected XSS vulnerability exists in FortiOS web proxy disclaimer response web pages, potentially exploitable by an unauthenticated attacker, via sending a maliciously crafted URL to the victim. The victim visiting the malicious URL would then have arbitrary javascript code executed in the...

CVE-2017-1230

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. This weakness may allow attackers to expose sensitive information by guessing tokens or identifiers. IBM X-Force ID: 123909...

FortiOS web GUI logindisclaimer redir parameter XSS vulnerability

A reflected XSS vulnerability exists in FortiOS web GUI "Login Disclaimer" redir parameter. It is potentially exploitable by a remote unauthenticated attacker, via sending a maliciously crafted URL to a victim who has an open session on the web GUI. Visiting that malicious URL may cause the...

CVE-2017-11825

Microsoft Office 2016 Click-to-Run C2R and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability...

Remote code execution

Microsoft Office 2016 Click-to-Run C2R and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability...

CVE-2017-11825

Microsoft Office 2016 Click-to-Run C2R and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability...

SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2017:2659-1)

This update for krb5 fixes several issues. This security issue was fixed : - CVE-2017-11462: Prevent automatic security context deletion to prevent double-free bsc1056995 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracte...

SUSE-SU-2017:2659-1 Security update for krb5

This update for krb5 fixes several issues. This security issue was fixed: - CVE-2017-11462: Prevent automatic security context deletion to prevent double-free bsc1056995 These non-security issues were fixed: - Set 'rdns' and 'dnscanonicalizehostname' to false in krb5.conf in order to improve clie...

PeaZip Compressed Filename Command Injection (CVE-2009-2261)

A command injection vulnerability exists in PeaZip. A remote attacker may exploit this vulnerability by sending a specially crafted Zip file to a target user, and convince him to open this file with PeaZip. Successful exploitation would allow an attacker to execute commands in the security contex...

DEBIAN-CVE-2017-11462

Double free vulnerability in MIT Kerberos 5 aka krb5 allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error...

CVE-2017-11462

CVE-2017-11462 is a reported double free vulnerability in MIT Kerberos 5 (krb5) with unspecified impact. The initial description states a double free allows attackers to cause unspecified effects via automatic deletion of security contexts on error. Connected documents reiterate the issue as a do...

PT-2017-12031

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 affected versions not specified Description A double free vulnerability in MIT Kerberos 5 allows attackers to have an unspecified impact via vectors involving automatic deletion of security contexts on error. Recommendations At...