718 matches found
HPE Intelligent Management Center deviceThresholdConfig.xhtml Code Execution
The vulnerability of the deviceThresholdConfig.xhtml component in the HPE Intelligent Management Center PLAT software is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using the beanName parameter...
CVE-2017-18039
The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the messagesThreshold parameter...
Citrix SD-WAN Path State Sensitivity Control Overview
Bad Loss Sensitive – Select a setting from the drop-down menu. The options are: Enable– Default If enabled, paths will be marked BAD due to loss, and will incur a path scoring penalty. Disable – Disabling Bad Loss Sensitive can be useful when the loss of bandwidth is intolerable. Custom – Select...
CVE-2015-5059
The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files $gviewprojdocthreshold is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the fileid parameter to...
ALPINE-CVE-2016-6128
The gdImageCropThreshold function in gdcrop.c in the GD Graphics Library aka libgd before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service application crash via an invalid color index...
DEBIAN-CVE-2016-6128
The gdImageCropThreshold function in gdcrop.c in the GD Graphics Library aka libgd before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service application crash via an invalid color index...
Debian: Security Advisory (DSA-3388-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
F5 Networks BIG-IP : NTP vulnerability (K10600056)
It was found that ntpd did not correctly implement the threshold limitation for the '-g' option, which is used to set the time without any restrictions. CVE-2015-5300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP...
Check Point response to NTP "panic threshold" Bypass Vulnerability (CVE-2015-5300)
...
Oracle Linux 7 : ntp (ELSA-2015-2231)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2231 advisory. - check origin timestamp before accepting KoD RATE packet CVE-2015-7704 - allow only one step larger than panic threshold with -g CVE-2015-5300 -...
[SECURITY] [DSA 3388-1] ntp security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3388-1 [email protected] https://www.debian.org/security/ Kurt Roeckx November 01, 2015 https://www.debian.org/security/faq -...
Ubuntu 14.04 LTS : NTP vulnerabilities (USN-2783-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2783-1 advisory. Aleksis Kauppinen discovered that NTP incorrectly handled certain remote config packets. In a non-default configuration, a remote authenticated attacker...
ntp: MITM attacker can force ntpd to make a step larger than the panic threshold
It was found that ntpd did not correctly implement the threshold limitation for the '-g' option, which is used to set the time without any restrictions. A man-in-the-middle attacker able to intercept NTP traffic between a connecting client and an NTP server could use this flaw to force that clien...
Important: Red Hat Security Advisory: ntp security update
Updated ntp packages that fix two security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available f...
Unspecified Vulnerability in Oracle MySQL Server (CNVD-2015-06840)
Oracle MySQL Server is an open source relational database management system from Oracle. This database system is characterized by high performance, low cost, good reliability and so on. An explicit vulnerability exists in Oracle MySQL Server versions prior to 5.6.25. Allows an authenticated remot...
PT-2015-6838
Name of the Vulnerable Software and Affected Versions NTP versions prior to 4.2.8p5 Description The issue allows remote attackers to bypass security restrictions by exploiting the failure to correctly implement the threshold limitation for the '-g' option. This can be achieved by responding to an...
A large number of Cisco security devices was traced to the presence of a default SSH key-vulnerability warning-the black bar safety net
! Cisco revealed that a large number of Cisco security devices was traced to the presence of a default SSH key, an attacker can use this vulnerability to control the device. The scope of the impact Cisco's security experts found that a lot of Cisco security devices in the presence of a default SS...
Windows 9 Start Menu Demo Video Leaked Online
After providing the glimpses of the next Windows, one of the screenshot leakers has now obtained a short video showing off a build of the very new Windows 9, aka "Threshold," features as well as how users can expect to use it. Two German sites, ComputerBase and WinFuture, posted 20 screenshots on...
Cloudflare: Password reset threshold not set
Your web application https://www.cloudflare.com does not have a password reset threshold set. this means that your client and users account can be flooded with password reset emails which can result in spam to the mailer's inbox. You should implement a threshold to prevent this attack...
Ensnare Web Application Attack Detection Utility Released
BOSTON – Two engineers from Netflix this week released to open source a security tool that detects attacks against web applications—and also reacts to those attacks with responses they hope will flummox a hacker to the point that he moves on to his next target. The utility is called Ensnare and i...