RedHat Update for qemu-kvm RHSA-2018:0023-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

(RHSA-2018:0026) Important: qemu-kvm security update

Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM. Security Fixes: An industry-wide issue was found in the way many modern microprocessor...

IKARUS anti.virus Multiple Denial of Service/BSOD Vulnerabilities

IKARUS anti.virus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

VMware ESXi, Workstation and Fusion updates address side-channel analysis due to speculative execution.

Bounds-Check bypass and Branch Target Injection issues CPU data cache timing can be abused to efficiently leak information out of mis-speculated CPU execution, leading to at worst arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts. Speculative...

WDMyCloud < 2.30.165 - Multiple Vulnerabilities

WDMyCloud Multiple Vulnerabilities Vendor: Western Digital Product: WDMyCloud Version: = 2.30.165 Website: https://www.wdc.com/products/network-attached-storage.html / / / / / / / / / / / / / / / / / / / / / \ / // / // / / / / / / / // / / / /,/// // /// // GulfTech Research and Development...

VMware Issues 3 Critical Patches for vSphere Data Protection

VMware, a Dell Technologies subsidiary, released several patches Tuesday fixing critical vulnerabilities affecting its vSphere cloud computing virtualization platform. The bugs address three vulnerabilities in VMware’s vSphere Data Protection VDP, a backup and recovery solution used with its...

Adobe ColdFusion Help Page Cross Site Scripting Vulnerability

Adobe ColdFusion is prone to a cross site scripting vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

F5 Networks BIG-IP : perl-XML-Twig vulnerability (K08383757)

perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting. CVE-2016-9180 Impact An authenticated user with a BIG-IP ASM administrative role, such as...

ALLPlayer ALLMediaServer 0.95 Buffer Overflow

Exploit Title: Buffer overflow in ALLPlayer ALLMediaServer 0.95 and earlier CVE: CVE-2017-17932 Date: 27-12-2017 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor Homepage: http://www.allmediaserver.org/ Category: webapps Attack Type: Remote Impact: Code execution...

F5 Networks BIG-IP : glibc vulnerability (K31211252)

Multiple stack-based buffer overflows in the GNU C Library aka glibc or libc6 before 2.23 allow context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via a long argument to the 1 nan, 2 nanf, or 3 nanl function. CVE-2014-9761 C Tenable Netwo...

GetGo Download Manager 5.3.0.2712 Buffer Overflow

Exploit Title: Buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 CVE: CVE-2017-17849 Date: 22-12-2017 Tested on Windows 10 32 bits Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Software Link: http://www.getgosoft.com/getgodm/ Category: webapps Attack...

F5 Networks BIG-IP : NTP vulnerability (K32262483)

The mx4200send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write...

F5 Networks BIG-IP : NTP vulnerability (K31310492)

Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response. CVE-2017-6460 C Tenable Network Security, Inc. The descriptive text and package chec...

F5 Networks BIG-IP : OpenSSH vulnerability (K20911042)

The dosetupenv function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as...

Unexpected file removal from datastore after failed NEA deployment

Challenge After a failed attempt to deploy NEA for tenants on the provider's side, all files from the datastore root folder including VM files are deleted. Cause This issue is caused by using only the " " space symbol for the NEA name and the deployment has failed. Veeam tries to detect failed NE...

WordPress Custom Map 1.1 Cross Site Scripting Vulnerability

WordPress Custom Map plugin version 1.1 suffers from a cross site scripting vulnerability. Product: Custom Map WordPress Plugin - https://wordpress.org/plugins/custom-map/ Vendor: webdesi9 Tested version: 1.1 CVE ID: CVE-2017-17744 CVE description A cross-site scripting XSS vulnerability in the...

Change Healthcare Conserus Image Repository archive solution XML External Entity Injection Vulnerability

Change Healthcare Conserus Image Repository archive solution is a medical diagnostic image storage solution from Change Healthcare, USA. An XML external entity injection vulnerability exists in Change Healthcare Conserus Image Repository archive solution version 2.1.1.105. A remote attacker can...

vBulletin <= 5.3.4 Arbitrary File Deletion And RCE Vulnerabilities

vBulletin is prone to arbitrary file deletion and remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...

Zoom Linux Client 2.0.106600.0904 Command Injection Vulnerability

The binary /opt/zoom/ZoomLauncher is vulnerable to command injection because it uses user input to construct a shell command without proper sanitization. The client registers a scheme handler zoommtg:// and this makes possible to trigger the vulnerability remotely. Version 2.0.106600.0904 is...

PT-2017-13251

Name of the Vulnerable Software and Affected Versions Conserus Image Repository archive solution version 2.1.1.105 Description A security issue was discovered in the Conserus Image Repository archive solution, allowing an unauthenticated user to exploit an XML External Entity XXE vulnerability. B...