Debian DLA-1640-1 : tmpreaper security update

It was discovered that tmpreaper, a program that cleans up files in directories based on their age, is vulnerable to a race condition. This vulnerability might be exploited by local attackers to perform privilege escalation. For Debian 8 'Jessie', this problem has been fixed in version...

exist-db:exist-core XML External Entity (XXE) vulnerability

exist version = 5.0.0-RC4 contains a XML External Entity XXE vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning...

Apereo Bedework bw-webdav XML External Entity Injection Vulnerability

Apereo Bedework bw-webdav is a general purpose webdav server. It is primarily used to interact with the backend to access resources. A security vulnerability exists in Apereo Bedework bw-webdav versions prior to 4.0.3. An attacker can exploit this vulnerability to perform an XML external entity...

Apple iOS and tvOS Profiles Certificate Configuration Vulnerability

Apple iOS and tvOS are both products of Apple Inc. Apple iOS is an operating system for mobile devices; tvOS is an operating system for smart TVs. profiles are a component of profiles. A security vulnerability exists in the Profiles component in Apple iOS versions prior to 12.1.1 and tvOS version...

SonarSource SonarQube Information Disclosure Vulnerability

SonarSource SonarQube is an open source code quality management platform from SonarSource Switzerland. The platform can detect code quality from seven dimensions , as well as through the form of plug-ins to support a variety of programming languages , including java, C, C/C++ and other code quali...

SAP Hybris Commerce Omni Commerce Connect API Server-Side Request Forgery Vulnerability

SAP Hybris Commerce is a SAP solution for handling high visitor and order volumes in e-commerce, and the Omni Commerce Connect API OCC is one of the full-service connectivity APIs. A server-side request forgery vulnerability exists in OCC in SAP Hybris Commerce version 6. The vulnerability stems...

Fortinet FortiWLC Hard-Coded Account Vulnerability

FortiWLC is a wireless controller from Fortinet. A hard-coded account vulnerability exists in Fortinet FortiWLC 8.3.3. An attacker can exploit this vulnerability to gain unauthorized read/write access via a remote shell...

Geist WatchDog Console XML External Entity Injection Vulnerability

Geist WatchDog Console is a suite of environmental monitoring software from Geist USA. An XML external entity injection vulnerability exists in Geist WatchDog Console version 3.2.2. A remote attacker can exploit this vulnerability to read arbitrary files with specially crafted XML data...

GEGL Denial of Service Vulnerability (CNVD-2018-08256)

GEGL is a data stream based image processing framework. The framework provides floating point processing and lossless image processing for projects such as the GNU Image Manipulation Program. A security vulnerability exists in GEGL 0.3.32 and earlier versions, which stems from a failure of the...

libxml Denial of Service Vulnerability

libxml2 is the GNOME project team developed a C-based library for parsing XML documents, which supports multiple encoding formats, Xpath parsing, Well-formed and valid validation. A security vulnerability exists in the 'xzdecomp' function of the xzlib.c file in libxml2 version 2.9.8. A remote...

screen-resolution-extra security bypass vulnerability

screen-resolution-extra is a screen resolution extension used in GNOME Desktop. A security vulnerability exists in screen-resolution-mechanism in screen-resolution-extra version 0.17.2, which stems from the program's failure to properly use the PolicyKit D-Bus API.A local attacker can exploit thi...

Cisco IOS XE Software Override Access Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A security vulnerability exists in Cisco IOS XE Software version 16.x, which arises from the use of a default username and password for an account with level 15 privileges. A remote attacker could use this...

Ipython Cross-Site Scripting Vulnerability

IPython is an enhanced version of Python's native interactive shell developed by the IPython team. A cross-site scripting vulnerability exists in version 3.x of Ipython prior to 3.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Artifex MuPDF Denial of Service Vulnerability (CNVD-2017-35030)

Artifex MuPDF is a free, lightweight PDF reader from Artifex Software. A security vulnerability exists in Artifex MuPDF version 1.11. The vulnerability can be exploited to execute arbitrary code or cause a denial of service with the help of a specially crafted .xps file...

Poppler Denial of Service Vulnerability

Poppler is a C++ class library for generating PDF, the library is inherited from Xpdf PDF reader. A denial of service vulnerability exists in the 'XRef::parseEntry' function of the XRef.cc file in Poppler version 0.59.0. An attacker can exploit this vulnerability with a specially crafted PDF...

Red5 Media Server Code Execution Vulnerability

Red5 Media Server is an open source and free streaming media server. A security vulnerability exists in AMF unmarshallers in Red5 Media Server versions prior to 1.0.8, which stems from a program that does not restrict classes when performing deserialization. A remote attacker can exploit this...

Unspecified Vulnerability in Red Hat Satellite

Red Hat Satellite is a suite of system management platforms from Red Hat, Inc. that can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A security vulnerability exists in Red Hat Satellite version 6. A local...

Cairo denial of service vulnerability

Cairo is a cross-platform open source vector graphics library developed by software developers Carl Worth and Behdad Esfahbod, which supports doing 2D drawings in multiple contexts and provides high-quality display and printouts. A denial of service vulnerability exists in Cairo version 1.15.4. A...

PT-2017-2040 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 25.0.0.148 and earlier Description: The issue is caused by a buffer overflow in memory due to an operation exceeding its boundaries in the Advanced Video Coding engine of the Flash Player platform. This can allow a...

Aerospike Database Server Information Disclosure Vulnerability

Aerospike Database Server is a distributed, scalable NoSQL database from Aerospike, Inc. An information disclosure vulnerability exists in Aerospike Database Server version 3.10.0.3. An attacker can exploit this vulnerability to obtain sensitive information...