CVE-2019-0016

A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Spac...

CVE-2019-0016

A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Spac...

CVE-2019-0017

The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1...

Security feature bypass

The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1...

Design/Logic Flaw

A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Spac...

CVE-2019-0017

The CVE-2019-0017 issue affects Juniper Networks Junos Space: the application allows uploading Device Image files but lacks proper validation, enabling potential uploading of malicious images or scripts. Affected releases are Junos Space before 18.3R1. The description notes an insufficient validi...

CVE-2019-0017 Junos Space: Unrestricted file upload vulnerability

The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1...

CVE-2019-0016

Junos Space is affected: Juniper Networks Junos Space versions prior to 18.3R1 allow a malicious authenticated user to delete a device from the database via crafted Ajax interactions that piggyback on another admin delete action. Root cause is a privilege/permission check bypass in the delete flo...

CVE-2019-0016 Junos Space: Authenticated user able to delete devices without delete device privileges

A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Spac...

Out-of-Bounds (OOB) Write

node is vulnerable to out-of-bounds OOB write. The library does not handle UCS-2 encoding properly, allowing a malicious user to write outside the bounds of the memory space of a Buffer...

Information Disclosure

Linxu kernel is vulnerable to information disclosure. It was found that the timer functionality in the Linux kernel ALSA subsystem is prone to a race condition between read and ioctl system call handlers, resulting in an uninitialized memory disclosure to user space. A local user could use this...

Denial Of Service (DoS)

undertow-core is vulnerable to denial of service attacks. The vulnerability exists when a GET request with very long URL about 1900 characters which exceeds the default buffer sizes is sent to the proxy server, it consumes 100% CPU and fills the disk space by generating logs very fast with an...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. The InfiniBand subsystem does not properly sanitize input parameters while registering memory regions from user space via the uverbs API, allowing a local user with access to a /dev/infiniband/uverbsX device crash the system or escalate their...

Arbitrary Code Execution

QEMU is vulnerable to arbitray code execution. A local guest user is able to write arbitrary data outside of VRAM-allocated buffer boundaries in the host's application address space due to insufficient checks in the Cirrus blit region, leading to execution of arbitrary code...

Information Disclosure

Linux kernel-rt is vulnerable to information disclosure. A NULL pointer dereference in the sndctlelemusertlv function in sound/core/control.c allows a local privileged user to exploit the vulnerability to leak kernel memory to user space...

Privilege Escalation

xen is vulnerable to privilege escalation attacks. The vulnerability exists as Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers...

privacyIDEA Improper Input Validation vulnerability

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=&pass= to /validate/check url. This vulnerability appears to have been fixed in...

systemd security update

219-62.0.4 - do not create utmp update symlinks for reboot and poweroff Orabug: 27854896 - OL7 udev rule for virtio net standby interface Orabug: 28826743 - fix netdev is missing for iscsi entry in /etc/fstab Orabug: 25897792 [email protected] - set 'RemoveIPC=no' in logind.conf as default fo...

[SECURITY] Fedora 29 Update: mingw-nettle-3.4.1-1.fc29

Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages C++, Python, Pike, ..., in applications like LSH or GNUPG, or even in kernel space...

[SECURITY] Fedora 28 Update: mingw-nettle-3.4.1-1.fc28

Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages C++, Python, Pike, ..., in applications like LSH or GNUPG, or even in kernel space...