Updated pacemaker packages fix security vulnerabilities

The updated packages fix security vulnerabilities: A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs. CVE-2019-3885 A flaw was found in the way pacemaker's client-server authenticatio...

DEBIAN-CVE-2014-2904

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

CVE-2014-2904

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

UBUNTU-CVE-2014-2904

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

Cross-site Request Forgery (CSRF)

apache solr is vulnerable to cross-site request forgery CSRF. A remote attacker with access to the server could perform HTTP GET requests to any reachable URL on behalf of the user. This is due to the shards parameter not having a corresponding whitelist mechanism, disallowing the server to...

CVE-2019-12500

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking...

pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc

A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...

pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc

A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...

CVE-2018-16877

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...

CVE-2018-16877

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...

USN-3795-3 libssh regression

USN-3795-1 and USN-3795-2 fixed a vulnerability in libssh. The upstream fix introduced a regression. This update fixes the problem. Original advisory details: Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this...

USN-3796-1 paramiko vulnerability

Daniel Hoffman discovered that Paramiko incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials...

USN-3795-1 libssh vulnerability

Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials...

F5 BIG-IP HTTPS health monitors design vulnerability

F5 BIG-IP LTM and so on are the products of F5 Corporation in the U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager; BIG-IP HTTPS health monitors is one of the HTTPS status monitoring programs. A security vulnerability exists in F5 BIG-IP HTTPS...

CVE-2018-0251

A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of that portal on an...

Cisco ASA Cross-Site Scripting Vulnerability

Cisco 3000 Series Industrial Security Appliances etc. are different series of security appliances from Cisco.Adaptive Security Appliance ASA Software is one of the operating systems.Clientless Secure Sockets Layer SSL VPN is one of the SSL Secure Sockets Layer VPN applications. A cross-site...

CVE-2018-6231

A server auth command injection authentication bypass vulnerability in Trend Micro Smart Protection Server Standalone versions 3.3 and below could allow remote attackers to escalate privileges on vulnerable installations...

HTTP Server Authentication Succeeded

This is an informational notice that the scanner was able to successfully authenticate against the web server using HTTP server credentials provided in the scan policy. No source data...

The vulnerability in the server component of the SAP POS software for automating accounting, sales, and production processes allows a perpetrator to read and delete files, shut down the Xpress Server, view the contents of the POS terminal, and attack user accounts.

The vulnerability in the server component of the SAP POS software for accounting, trading, and production automation lies in the absence of authentication procedures during file reading, operation completion, daemon shutdown, and terminal reading. Exploiting this vulnerability allows a malicious...

Design/Logic Flaw

In X.Org Server aka xserver and xorg-server before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp...