Design/Logic Flaw

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user...

Unspecified vulnerability in frysk package

frysk is a scalable system monitoring and debugging tool. A security vulnerability in the frysk package 2008-08-05 and earlier versions used in Red Hat Enterprise Linux version 5 can be exploited by a local attacker to execute arbitrary code as another user...

Bolt CMS Cross-Site Request Forgery Vulnerability (CNVD-2019-36972)

Bolt CMS is a PHP-based open source content management system for the Bolt community. Bolt CMS cross-site request forgery vulnerability, an attacker can exploit the vulnerability in the user has logged into the target site , to induce the user to visit an attack page , to take advantage of the...

Vulnerability fixed in OpenSSL

The developers of OpenSSL have mitigated a vulnerability. The vulnerability consists of some implementations of OpenSSL, the configuration file and possibly executables of OpenSSL can be modified by a local malicious person logged in as a user logged in. The developers indicate that the number of...

MGASA-2019-0063 Updated cinnamon packages fix security vulnerability

A flaw was found in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of for example other users' icon files in onfacebrowsemenuitemactivated and onfacemenuitemactivated. These icon files are written to the respective user's $HOME/.face locatio...

CVE-2016-7543

Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables...

kernel: NULL dereference in RFCOMM bind callback

The rfcommsockbind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service NULL pointer dereference via vectors involving a bind system call on a Bluetooth RFCOMM socket...

CVE-2016-4748

Perl in Apple OS X before 10.12 allows local users to bypass the taint-mode protection mechanism via a crafted environment variable...

CVE-2016-3992

cronic before 3 allows local users to write to arbitrary files via a symlink attack on a 1 cronic.out.$$, 2 cronic.err.$$, or 3 cronic.trace.$$ file in /tmp...

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to InnoDB...

UBUNTU-CVE-2016-0643

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML...

DEBIAN-CVE-2015-0856

daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme...

kernel: ASLR bruteforce possible for vdso library

An information leak flaw was found in the way the Linux kernel's Virtual Dynamic Shared Object vDSO implementation performed address randomization. A local, unprivileged user could use this flaw to leak kernel memory addresses to user-space...

CVE-2015-2830

arch/x86/kernel/entry64.S in the Linux kernel before 3.19.2 does not prevent the TSCOMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the 1 fork or 2 close system call, as demonstrated b...

PYSEC-2015-37

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

CVE-2014-9065

common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service write denial or NMI watchdog timeout and host crash via a large number of read requests, a different vulnerability to CVE-2014-9066...

CVE-2014-8559

The dwalk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of renamelock, which allows local users to cause a denial of service deadlock and system hang via a crafted application...

MGASA-2014-0034 Updated pidgin package fixes security vulnerabilities

Many places in the Yahoo! protocol plugin assumed incoming strings were UTF-8 and failed to transcode from non-UTF-8 encodings. This can lead to a crash when receiving strings that aren't UTF-8 CVE-2012-6152. A remote XMPP user can trigger a crash on some systems by sending a message with a...

CVE-2013-1444

A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222...

CVE-2013-1775

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch...