Cisco ASR 903/ASR 920 Series Denial of Service Vulnerability

The Cisco ASR 903 and ASR 920 are router products. A security vulnerability exists in the Cisco ASR 903ASR 920 series devices using RSP2 cards due to ineffective handling of IPv6 packets. An unauthenticated, physically proximate attacker caused a denial of service on the affected system...

CVE-2016-6022

IBM Quality Manager RQM 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference : 20007...

IBM Security Identity Manager Cross-Site Request Forgery Vulnerability (CNVD-2017-04428)

IBMSecurityIdentityManager ISIM is a suite of identity management and governance solutions from IBM, USA. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password management. A cross-si...

CVE-2017-3850

A vulnerability in the Autonomic Networking Infrastructure ANI feature of Cisco IOS Software 15.4 through 15.6 and Cisco IOS XE Software 3.7 through 3.18, and 16 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to incomplete inpu...

CVE-2017-6356

Palo Alto Networks Terminal Services aka TS Agent 6.0, 7.0, and 8.0 before 8.0.1 uses weak permissions for unspecified resources, which allows attackers to obtain sensitive session information via unknown vectors...

CVE-2017-3868

A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. More Information: CSCvc44344. Known Affected Release...

CVE-2016-9006

IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference : C1000264...

kernel: use after free in dccp protocol

A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol DCCP implementation freed SKB socket buffer resources for a DCCPPKTREQUEST packet when the IPV6RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the...

ESET Endpoint Antivirus 6 Remote Code Execution Vulnerability

ESET Endpoint Antivirus is a new generation of anti-virus product developed by ESET for SME and enterprise customers. It utilizes a scanning technology that whitelists safe files based on the results of a risk database comparison to improve overall system performance. A remote code execution...

CVE-2016-9316

Multiple stored Cross-Site-Scripting XSS vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allow authenticated, remote users with least privileges to inject arbitrary...

CVE-2016-9315

Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or ad...

UBUNTU-CVE-2016-5417

Memory leak in the resvinit function in the IPv6 name server management code in libresolv in GNU C Library aka glibc or libc6 before 2.24 allows remote attackers to cause a denial of service memory consumption by leveraging partial initialization of internal resolver data structures...

CVE-2017-3822

A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense FTD Firepower Device Manager FDM could allow an unauthenticated, remote attacker to add arbitrary entries to the audit log. This vulnerability affects Cisco Firepower Threat Defense Software versions 6.1.x on the...

DEBIAN-CVE-2017-5597

In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dhcpv6.c by changing a data type to avoid an integer overflow...

CVE-2017-0388

An elevation of privilege vulnerability in the External Storage Provider could enable a local secondary user to read data from an external storage SD card inserted by the primary user. This issue is rated as High because it is a general bypass for operating system protections that isolate...

DEBIAN-CVE-2016-9755

The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local users to cause a denial of service integer overflow, out-of-bounds write, and GPF or possibly have unspecified other impact via a crafted application that makes socket, connect, and writev system...

VMware ESXi HTML Injection Vulnerability

VMware ESXi is a bare-metal virtualization hypervisor from VMware that is installed directly on a physical server and divides the physical server into multiple virtual machines. The program features less disk space, higher reliability and security. An HTML injection vulnerability exists in VMware...

Apple iCloud for Windows Information Disclosure Vulnerability

Apple iCloud for Windows is a Windows-based cloud service from Apple USA that supports storage of music, photos, apps, contacts, etc. Windows Security is one of the security components. An information disclosure vulnerability exists in the Windows Security component of Apple iCloud for Windows...

PT-2016-2919 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.8.12 Description: The issue exists due to insufficient input validation in the icmp6 send function. Exploitation of this issue may allow a remote attacker to cause a denial of service using a specially crafted...

RedHat Jboss Fuse and Jboss A-MQ Denial of Service Vulnerabilities

Red Hat JBoss Fuse and JBoss A-MQ are both products of Red Hat's JBoss middleware.JBoss Fuse is an open source enterprise service bus platform.JBoss A-MQ is an open source messaging platform. A denial of service vulnerability exists in RedHat Jboss Fuse and Jboss A-MQ version 6. An attacker could...