8412 matches found
Vulnerability of Cisco Nexus 7000 software, allowing attackers to access confidential information
The GNU Bash command shell, as of version 4.3 bash43-025 and later, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other undefined actions...
Vulnerability of Cisco ACS software, allowing a malicious individual to access confidential information
The GNU Bash command shell, as of version 4.3 bash43-025, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other unconfirmed actions. Security...
The vulnerability of Cisco Nexus 1000V software allows a malicious individual to gain access to confidential information.
The GNU Bash command shell, as of version 4.3 bash43-025, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other unconfirmed actions. Security...
The vulnerability of the GNU Bash command-line interpreter allows a malicious actor to cause a service failure or execute arbitrary code.
The vulnerability of the GNU Bash command-line interpreter arises from errors in the processing of input data during syntax analysis of code. Exploiting this vulnerability allows a malicious individual to execute arbitrary code with the privileges of the current user whenever the command-line...
The vulnerability of the Serv-U File Server allows a remote attacker to obtain information about the system’s configuration and user authentication credentials.
The vulnerability of the Serv-U File Server software relates to errors that occur during the processing of application variables. Exploiting this vulnerability allows a malicious attacker to obtain system configuration information, including user authentication data...
OracleVM 3.2 : sudo (OVMSA-2016-0079)
The remote OracleVM system is missing necessary patches to address critical security updates : - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210 - backported fixes for CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-277...
Discuz! x the use of SSRF remote command execution vulnerability
Content source: security think tank 0X01 ready to work jannock issued by Discuz conditional remote command execution,a lot of big stations affected, the online hasn't published details, in a safe public number to see on the jannock simple to say about the principle, is ssrf+redis/memcache issues,...
WooCommerce plugin for WordPress: source code security analysis report
Several vulnerabilities were discovered in WooThemes 'WooCommerce plugin for WordPress' software: File System Path Manipulation Using Global Variables Incorrect Newline Symbol Filtration in HTTP-response Headers Hardcoded Credentials...
SUSE-SU-2016:1528-1 Security update for openssh
openssh was updated to fix three security issues. These security issues were fixed: - CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to...
Updated ntp packages fix security vulnerability
ntpq and ntpdc disclose the origin timestamp to unauthenticated clients, which may allow an attacker to impersonate a legitimate peer CVE-2015-8139. An attacker who is able to spoof packets with correct origin timestamps from enough servers before the expected response packets arrive at the targe...
jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...
ntp: distributed denial of service amplification
CVE-2016-4953 distributed denial of service amplification An attacker who knows the origin timestamp and can send a spoofed packet containing a CRYPTO-NAK to an ephemeral peer target before any other response is sent can demobilize that association. Credit to Miroslav Lichvar of Red Hat -...
Unspecified vulnerability in ntpd (CNVD-2016-03821)
ntpd Network Time Protocol daemon is an operating system daemon that uses the Network Time Protocol NTP to keep synchronized with the system time of a time server. An unspecified vulnerability exists in versions of ntpd prior to 4.2.8p8. An attacker can exploit this vulnerability to affect siblin...
Unspecified vulnerability in ntpd (CNVD-2016-03822)
ntpd Network Time Protocol daemon is an operating system daemon that uses the Network Time Protocol NTP to keep synchronized with the system time of a time server. An unspecified vulnerability exists in NTP.org ntpd versions prior to 4.2.8p8. An attacker can exploit this vulnerability by sending...
CMSimple CMS: source code security analysis report
Several vulnerabilities were discovered in CMSimple 'CMSimple CMS' software: File System Path Manipulation Incorrect User Input Filtration when Using Regular Expressions while Calling the pregreplace Function Using Global Variables Using Insufficiently Random Generators in Cryptography HttpOnly...
Concrete5 CMS: source code security analysis report
Several vulnerabilities were discovered in Portland Labs 'Concrete5 CMS' software: File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in Cryptography HttpOnly Cookies Incorrect Permissions...
CVE-2016-3721
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...
CVE-2016-3721
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...
