USN-3469-1: Linux kernel vulnerabilities

Anthony Perard discovered that the Xen virtual block driver did not properly initialize some data structures before passing them to user space. A local attacker in a guest VM could use this to expose sensitive information from the host OS or other guest VMs. CVE-2017-10911 Bo Zhang discovered tha...

Command injection

A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0.10. An attacker with access to the product's web API can exploit this vulnerability to completely compromise the vulnerable device...

CVE-2017-9377

A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0.10. An attacker with access to the product's web API can exploit this vulnerability to completely compromise the vulnerable device...

CVE-2017-9377

Barco ClickShare Base Unit devices (CSM-1 firmware before 1.7.0.3; CSC-1 firmware before 1.10.0.10) are affected by CVE-2017-9377. A command injection vulnerability exists that an attacker with access to the product’s web API can exploit to completely compromise the affected device. The available...

Linux kernel x86/fpu (Floating Point Unit) subsystem information disclosure vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. x86/fpu Floating Point Unit subsystem is one of the 32-bit floating point unit subsystems. A security vulnerability exists in the x86/fpu Floating Point Unit subsystem in...

actionpack vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the numbertocurrency helper in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter...

CVE-2017-2132

Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB10004.47 allow an attacker to delete arbitrary files in a specific directory via unspecified vectors...

CVE-2017-2133

SQL injection vulnerability in Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB10004.47 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-2133

SQL injection vulnerability in Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB10004.47 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

Panasonic Home Unit KX-HJB1000 Access Bypass Vulnerability

The Panasonic KX-HJB1000 Home unit devices is a webcam from Panasonic Japan. An access bypass vulnerability exists in the Panasonic Home Unit KX-HJB1000. An attacker can use this vulnerability to bypass access restrictions and view configuration menus...

Panasonic Home Unit KX-HJB1000 SQL Injection Vulnerability

The Panasonic KX-HJB1000 Home unit devices is a webcam from Panasonic Japan. A SQL injection vulnerability exists in Home unit KX-HJB1000. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

Panasonic Home Unit KX-HJB1000 Arbitrary File Deletion Vulnerability

The Panasonic KX-HJB1000 Home unit devices is a webcam from Panasonic Japan. An arbitrary file deletion vulnerability exists in the Panasonic Home Unit KX-HJB1000. An attacker can use this vulnerability to delete arbitrary files in a directory...

Design/Logic Flaw

The x86/fpu Floating Point Unit subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace or rtsigreturn system call, allowing local users to read...

CVE-2017-15537

The x86/fpu Floating Point Unit subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace or rtsigreturn system call, allowing local users to read...

UBUNTU-CVE-2017-15537

The x86/fpu Floating Point Unit subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace or rtsigreturn system call, allowing local users to read...

CVE-2017-10607

Juniper Networks Junos OS 16.1R1, and services releases based off of 16.1R1, are vulnerable to the receipt of a crafted BGP Protocol Data Unit PDU sent directly to the router, which can cause the RPD routing process to crash and restart. Unlike BGP UPDATEs, which are transitive in nature, this...

Design/Logic Flaw

Juniper Networks Junos OS 16.1R1, and services releases based off of 16.1R1, are vulnerable to the receipt of a crafted BGP Protocol Data Unit PDU sent directly to the router, which can cause the RPD routing process to crash and restart. Unlike BGP UPDATEs, which are transitive in nature, this...

WordPress WP-Contact-Widgets 1.4.1 Cross Site Scripting Vulnerability

WordPress WP-Contact-Widgets plugin version 1.4.1 suffers from a stored cross site scripting vulnerability. Exploit Title: Stored XSS on wp-contact-widgets 1.4.1 wordpress plugin Exploit Author: Boumediene KADDOUR Publisher: R&D Unit Algerie Telecom Version: 1.4.1 Application website:...

DEBIAN-CVE-2017-12188

arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service incorrect index...

FreeMilk Phishing Scam Hijacks Active Email Conversations to Deploy Malware

By Waqas The IT security researchers at Palo Alto Networks Unit 42 This is a post from HackRead.com Read the original post: FreeMilk Phishing Scam Hijacks Active Email Conversations to Deploy Malware...