The vulnerability of the reposync function of the YUM package manager, which allows a hacker to create, modify, or delete any files they desire.

The vulnerability of the reposync function in the YUM package manager exists due to insufficient restrictions on the path name of the restricted access directory. Exploiting this vulnerability allows a malicious actor to create, modify, or delete any files as desired from a remote location...

Use-After-Free

Linux kernel is vulnerable to privilege escalation. A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKETV3 ring buffer. A local user able to op...

Validation Bypass

ntp is vulnerable to validation bypass. It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or...

Denial Of Service (DoS)

ntp is vulnerable to denial of service. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and...

The vulnerability of the implementation of TLS and SSL software such as Mbed TLS lies in the local synchronization during RSA decryption, which allows attackers to gain access to protected information.

The vulnerability of the implementation of TLS and SSL software developed by Mbed TLS relates to local synchronization during RSA decryption. Exploiting this vulnerability can allow attackers to gain access to protected information...

[SECURITY] Fedora 29 Update: systemd-239-8.gite339eae.fc29

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

CVE-2019-6133: Concurrent Execution using Shared Resource with Improper Synchronization

In PolicyKit aka polkit 0.115, the "start time" protection mechanism can be bypassed because fork is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c...

Design/Logic Flaw

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

CVE-2017-9704

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

CVE-2017-9704

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

CVE-2017-9704

CVE-2017-9704 concerns CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) where there is no synchronization between msm_vb2 buffer operations, enabling a use-after-free condition. Root cause: missing synchronization in buffer handling within the kernel component msm_vb2. Affec...

CVE-2018-17244: Concurrent Execution using Shared Resource with Improper Synchronization

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

PT-2018-3560

Name of the Vulnerable Software and Affected Versions: WildFly versions up to 16.0.0.Final Description: A flaw in WildFly allows local users who can execute init.d scripts to terminate arbitrary processes on the system. This can be exploited by modifying the PID file in /var/run/jboss-eap/,...

Crowd silently ignores changes to active status of users in Azure AD.

When Crowd synchronises users for the very first time from Azure AD it will recognise "active" state of users correctly. Unfortunately, on next synchronisations Crowd ignores changes to these statuses, so once they are set, they will never change...

Step 1. Identify users: top 10 actions to secure your environment

This series outlines the most fundamental steps you can take with your investment in Microsoft 365 security solutions. Well provide advice on activities such as setting up identity management through active directory, malware protection, and more. In this post, we explain how to create a single...

Salesforce Suite - Moderately critical - Access bypass - SA-CONTRIB-2018-078

This module enables Drupal to synchronize entities with Salesforce records. The module includes a page that does not sufficiently protect access rights, resulting in potential information disclosure. This vulnerability is mitigated by the fact that only Drupal entity title and IDs, and Salesforce...

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin 10.0.0 through 10.0.7, and Vaadin 11.0.0 through 11.0.2 allows attacker to update element property values via crafted synchronization message. See CWE-754: Improper Check for Unusual or Exceptional...

PT-2018-3377

Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: The issue is related to the use of a shared resource with incorrect synchronization during file renaming in the QEMU hardware emulator, specifically in the v9fs wstat function. This can be...

Yi Home Camera Firmware Downgrade Vulnerability

Yi Home Camera is an IoT home camera sold worldwide. A firmware downgrade vulnerability exists in the time synchronization feature of the Yi Home Camera 27US 1.8.7.0D. An attacker can cause a buffer overflow by intercepting and altering network traffic and exploiting the vulnerability via special...

[SECURITY] Fedora 28 Update: systemd-238-10.git438ac26.fc28

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...