CVE-2010-3582

CVE-2010-3582 concerns Oracle VM 2.2.1, where an input validation flaw in the Oracle VM Server Agent’s XML-RPC processing (utl_test_url) enables a remote authenticated attacker to inject commands with root privileges, compromising confidentiality, integrity, and availability. The issue is specifi...

CVE-2010-3584

Unspecified vulnerability in the Oracle VM component in Oracle VM 2.2.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to ovs-agent. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims fro...

CVE-2010-3584

CVE-2010-3584 affects Oracle VM 2.2.1, specifically the ovs-agent component. The issue, described as a local privilege escalation, arises from how Oracle VM Agent stores authentication data in files with weak permissions, enabling a local user to affect confidentiality, integrity and availability...

CVE-2010-3585

Unspecified vulnerability in the OracleVM component in Oracle VM 2.2.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to ovs-agent. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented...

CVE-2010-3585

Oracle VM 2.2.x ovs-agent exposed XML-RPC endpoints allowing authenticated remote users to trigger command execution as root, leading to potential full compromise of the Oracle VM Server and its guests. Public records indicate an XML-RPC exposure enabling function calls not aligned with intended ...

CVE-2010-3583

CVE-2010-3583 is tied to Oracle VM 2.2.1, where the Oracle VM Agent (ovs-agent) exposes functions via XML-RPC. A vulnerability exists in the ovs-agent channel that can allow an authenticated, remote attacker to execute arbitrary OS commands, impacting confidentiality, integrity, and availability ...

Oracle Virtual Server Agent Command Injection

Exploit for unix platform in category remote exploits ============================================= Oracle Virtual Server Agent Command Injection ============================================= 1. Advisory Information Advisory ID: BONSAI-2010-0109 Date published: 2010-10-13 Vendors contacted: Oracl...

Oracle Virtual Server Agent Command Injection

Oracle Virtual Server Agent Command Injection ============================================= 1. Advisory Information Advisory ID: BONSAI-2010-0109 Date published: 2010-10-13 Vendors contacted: Oracle Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely...

Oracle Virtual Server Agent - Command Injection

Oracle Virtual Server Agent - Command Injection Oracle Virtual Server Agent Command Injection ============================================= 1. Advisory Information Advisory ID: BONSAI-2010-0109 Date published: 2010-10-13 Vendors contacted: Oracle Release mode: Coordinated release 2. Vulnerability...

Bonsai Information Security - Oracle Virtual Server Agent Command Injection

Oracle Virtual Server Agent Command Injection ============================================= 1. Advisory Information Advisory ID: BONSAI-2010-0109 Date published: 2010-10-13 Vendors contacted: Oracle Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely...

Oracle Virtual Server Agent - Command Injection

Oracle Virtual Server Agent Command Injection ============================================= 1. Advisory Information Advisory ID: BONSAI-2010-0109 Date published: 2010-10-13 Vendors contacted: Oracle Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely...

Oracle Releases Critical Patch for October 2010

Oracle has released its Critical Patch Update for October 2010 to address 85 vulnerabilities across multiple products. This update contains the following security fixes: 7 for Oracle Database Server 8 for Oracle Fusion Middleware 1 for Oracle Enterprise Manager Grid Control 6 for Oracle E-Busines...

Oracle VM Server Virtual Server Agent Command Injection

This module exploits a command injection flaw within Oracle's VM Server Virtual Server Agent ovs-agent service. By including shell meta characters within the second parameter to the 'utltesturl' XML-RPC methodCall, an attacker can execute arbitrary commands. The service typically runs with root...

CVE-2010-2399

Unspecified vulnerability in Oracle Solaris 10 and OpenSolaris allows local users to affect availability via unknown vectors related to Kernel/VM...

Design/Logic Flaw

Unspecified vulnerability in Oracle Solaris 10 and OpenSolaris allows local users to affect availability via unknown vectors related to Kernel/VM...

CVE-2010-2399

CVE-2010-2399 affects Oracle Solaris 10 and OpenSolaris (Kernel/VM). Descriptions specify a local vulnerability that can impact availability via unknown vectors; root cause and exploit details are not disclosed in the provided documents. No patch/fix details are given for this CVE within the conn...

CVE-2010-2399

Unspecified vulnerability in Oracle Solaris 10 and OpenSolaris allows local users to affect availability via unknown vectors related to Kernel/VM...

Design/Logic Flaw

Virtual Desktop Server Manager VDSM in Red Hat Enterprise Virtualization Hypervisor aka RHEV-H or rhev-hypervisor before 5.5-2.2 does not properly perform VM post-zeroing after the removal of a virtual machine's data, which allows guest OS users to obtain sensitive information by examining the di...

CVE-2010-2223

CVE-2010-2223 affects Red Hat Enterprise Virtualization Hypervisor (RHEV-H) with Virtual Desktop Server Manager (VDSM). The issue: when removing a VM’s data, VDSM did not securely zero/delete the back-end data, allowing a guest OS user to examine disk blocks from deleted VMs and potentially discl...

flash-plugin: multiple security flaws (APSB10-14)

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service memory corruption or possibly execute arbitrary code via an invalid offset in an unspecified undocumented opcode in ActionScript Virtual Machine 2, relat...