[SECURITY] Fedora 29 Update: curl-7.61.1-7.fc29

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 29 Update: gvfs-1.38.1-2.fc29

The gvfs package provides backend implementations for the gio framework in GLib. It includes ftp, sftp, cifs...

CVE-2019-6111

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned only directory traversal attacks are prevented...

CVE-2018-20685

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side...

SolarWinds SFTP Server Detection (Windows SMB Login)

This script detects the installed version of SolarWinds SFTP Server for Windows. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

SolarWinds SFTP Insecure Password Storage Vulnerability

SolarWinds SFTP is an FTP service program. An insecure password storage vulnerability exists in SolarWinds SFTP. The vulnerability is due to the configuration file being globally readable and writable and storing user passwords in an insecure manner, allowing an attacker to determine passwords fo...

SolarWinds SFTP XXE Vulnerability

SolarWinds SFTP is an FTP service program. SolarWinds SFTP is vulnerable to XXE. Allows an attacker to filter a global readable and writable profile of data to XXE...

Design/Logic Flaw

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data...

CVE-2018-16791

In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...

CVE-2018-16792

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data...

Design/Logic Flaw

In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...

CVE-2018-16791

In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...

CVE-2018-16791

In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...

CVE-2018-16792

CVE-2018-16792 : SolarWinds SFTP/SCP server up to 2018-09-10 is vulnerable to XXE via a world-readable/writable configuration file, enabling data exfiltration. CVSS v3.1 base score 9.1 (CRITICAL), network attack, no authentication required. Connected documents corroborate the XXE description; no ...

CVE-2018-16792

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data...

CVE-2018-16791

The CVE concerns SolarWinds SFTP/SCP Server (through 2018-09-10). The configuration file is world-readable and writable, and passwords are stored insecurely, enabling an attacker to determine passwords for privileged accounts and potentially backdoor the server. The connected references (NVD/CNVD...

openSUSE: Security Advisory for openssh (openSUSE-SU-2018:3946-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2018:3910-1 Security update for openssh

This update for openssh fixes the following issues: Following security issues have been fixed: - CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully...

[SECURITY] Fedora 28 Update: curl-7.59.0-9.fc28

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...