4180 matches found
CVE-2016-4984
/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it...
Fedora 25 : libdb (2017-372bb1edb3)
Security fix for DBCONFIG parsing when dbhome is not set. This update also introduces modified fixes for rhbz1394862 once again and additionally fixes ppc specific hangs described in rhbz1460003. Please be aware that this update is expected to cause DBVERSIONMISMATCH errors during installation if...
CVE-2016-10397
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:[email protected]/ and evil.example.com:[email protected]/ inputs to the parseurl...
CVE-2016-10397
Removed by vendor...
CVE-2016-10397
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:[email protected]/ and evil.example.com:[email protected]/ inputs to the parseurl...
PT-2017-4184
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.28 PHP versions 7.x prior to 7.0.13 Description The issue arises from incorrect handling of various URI components in the URL parser, which could allow attackers to bypass hostname-specific URL checks. This is...
CVE-2016-10397
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:[email protected]/ and evil.example.com:[email protected]/ inputs to the parseurl...
www2.cdc.gov XSS vulnerability
Vulnerable URL: https://www2.cdc.gov/nip/isd/YCTS/mod1/courses/pneumo/10317.asp?studentid=1"...
GLPI SQL Injection Vulnerability
GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A SQL injection vulnerability exists in GLPI version 0.90.4. A remote...
asu.edu XSS vulnerability
Vulnerable URL: http://www.asu.edu/courses/rel394ae/flashdetection.swf?flashContentURL=javascript:alert%27openbugbounty%27// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 15.09.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2557 VIP...
CVE-2017-7752
A use-after-free vulnerability during specific user interactions with the input method editor IME in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox 54, Firefox...
Trend Micro IWSVA ReportHandler DoCmd Command Injection
An authentication bypass vulnerability has been reported in HPE Intelligent Management Center. The vulnerability is due to errors in handling specific strings contained in the request URI. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted request to the target...
Introducing InsightOps: A New Approach to IT Monitoring and Troubleshooting
Today we are announcing the general availability of a brand new solution: Rapid7 InsightOps. This latest addition to the Insight platform continues our mission to transform data into answers, giving you the confidence and control to act quickly. InsightOps is Rapid7s first IT-specific solution,...
Lenovo Connect2 Ad-hoc Wifi Network Key Stored in User-readable Location - Lenovo Support US
No description provided...
openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2017-629)
This update for java-170-openjdk fixes the following issues : - Update to 2.6.10 - OpenJDK 7u141 bsc1034849 - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-351...
F5 BIG-IP - TMM vulnerability CVE-2017-6137
Undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disruption of service to the Traffic Management Microkernel TMM on specific platforms and configurations. CVE-2017-6137 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be...
Moxa AWK-3131A Wireless Access Point Information Disclosure Vulnerability (CNVD-2017-07354)
Moxa AWK-3131A Wireless Access Point is a wireless switch from Moxa, China.Web Application is one of the web application modules. An information disclosure vulnerability exists in the Web Application feature of the Moxa AWK-3131A Wireless Access Point using firmware version 1.1. An attacker can...
PT-2017-18663
Name of the Vulnerable Software and Affected Versions GNU Binutils version 2017-04-03 Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash. This is related to the process mips specific function in readelf.c, whic...
PT-2017-18664
Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.28 Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, by providing a crafted ELF file. This is related to the mishandling of MIPS...
USN-3291-2: Linux kernel vulnerabilities
USN-3291-1 fixed vulnerabilities in the generic Linux kernel. This update provides the corresponding updates for the Linux kernel built for specific processors and cloud environments. Dmitry Vyukov discovered that the generic SCSI sg subsystem in the Linux kernel contained a stack-based buffer...