systemd - reexec State Injection

systemd - reexec State Injection / I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at https://github.com/systemd/systemd/blob/master/docs/CONTRIBUTING.mdsecurity-vulnerability-reports . When systemd re-executes e.g. during a package upgrade, state is...

systemd - 'reexec' State Injection

/ I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at https://github.com/systemd/systemd/blob/master/docs/CONTRIBUTING.mdsecurity-vulnerability-reports . When systemd re-executes e.g. during a package upgrade, state is serialized into a memfd before the execv...

Linux systemd Line Splitting

systemd: reexec state injection: fgets on overlong lines leads to line splitting CVE-2018-15686 I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at https://github.com/systemd/systemd/blob/master/docs/CONTRIBUTING.mdsecurity-vulnerability-reports . When system...

openvswitch: Invalid processing of a malicious OpenFlow role status message

While parsing an OpenFlow role status message Open vSwitch OvS, a call to the abort function for undefined role status reasons in the function 'ofpprintrolestatusmessage' in 'lib/ofp-print.c' could be misused for a remote denial of service attack by a malicious switch...

Open vSwitch Denial of Service Vulnerability

Open vSwitch OvS is a multi-layer virtual switch product based on open source technology following the Apache 2.0 license that supports large-scale network automation through programmatic extensions, standard management interfaces and protocols, and more. A denial of service vulnerability exists ...

CVE-2017-9263

In Open vSwitch OvS 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort function for undefined role status reasons in the function ofpprintrolestatusmessage in lib/ofp-print.c that may be leveraged toward a remote DoS attack by a malicious switch...

Design/Logic Flaw

In Open vSwitch OvS 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort function for undefined role status reasons in the function ofpprintrolestatusmessage in lib/ofp-print.c that may be leveraged toward a remote DoS attack by a malicious switch...

DEBIAN-CVE-2017-9263

In Open vSwitch OvS 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort function for undefined role status reasons in the function ofpprintrolestatusmessage in lib/ofp-print.c that may be leveraged toward a remote DoS attack by a malicious switch...

CVE-2017-9263

CVE-2017-9263 affects Open vSwitch 2.7.0 where parsing an OpenFlow role status message can trigger abort() on undefined role status reasons in lib/ofp-print.c, enabling a remote DoS via a malicious switch. This is the core issue described across security notices (RHSA advisories and OSV entries) ...

ZMS v3.2 CMS - Client Side Cross Site Web Vulnerabilities

Document Title: =============== ZMS v3.2 CMS - Client Side Cross Site Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1890 Release Date: ============= 2016-07-28 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2016-2058

Multiple cross-site scripting XSS vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow 1 remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or 2 remote authenticated users to inject arbitra...

CloudBees Jenkins Cross-Site Scripting Vulnerability (CNVD-2015-07821)

CloudBees Jenkins is the open source continuous integration server. A cross-site scripting vulnerability exists in CloudBees Jenkins 1.638, LTS versions prior to 1.625.2, in the slave overview page, where a remote user with certain privileges can inject web script or HTML via a slave offline stat...

Cisco TelePresence ISDN Gateway D-Channel DoS

According to its self-reported version number, the remote device is affected by a vulnerability that could allow an unauthorized user to cause a denial of service via a specially crafted Q.931 STATUS message. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid72184;...

Skype 5.3.x 2.2.x 5.2.x - Persistent Software Vulnerability

Document Title: =============== Skype 5.3.x 2.2.x 5.2.x - Persistent Software Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=182 CNNVD-201110-709 http://www.cnnvd.org.cn/vulnerability/show/cvid/2011100709 Release Date: =============...

Skype 5.3.x 2.2.x 5.2.x - Persistent Software Vulnerability

Document Title: =============== Skype 5.3.x 2.2.x 5.2.x - Persistent Software Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=182 CNNVD-201110-709 http://www.cnnvd.org.cn/vulnerability/show/cvid/2011100709 Release Date: =============...

Mandriva Linux Security Advisory : pidgin (MDVSA-2010:148)

A security vulnerability has been identified and fixed in pidgin : The clientautoresp function in familyicbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service NULL pointer dereference and application crash via an...

webNetwork Persistent XSS Vulnerability

Exploit for php platform in category web applications ======================================= webNetwork Persistent XSS Vulnerability ======================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ ...

CVE-2010-2528

The clientautoresp function in familyicbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service NULL pointer dereference and application crash via an X-Status message that lacks the expected end tag for a 1 desc or 2 titl...

Null pointer dereference

The clientautoresp function in familyicbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service NULL pointer dereference and application crash via an X-Status message that lacks the expected end tag for a 1 desc or 2 titl...

CVE-2010-2528

The clientautoresp function in familyicbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service NULL pointer dereference and application crash via an X-Status message that lacks the expected end tag for a 1 desc or 2 titl...