CVE-2021-44142

Samba's vfs_fruit module is vulnerable to an out-of-bounds heap read and write caused by specially crafted extended file attributes (EA, xattr). This flaw affects Samba versions prior to 4.13.17, 4.14.12, and 4.15.5 when the module is configured. A remote attacker with write access to extended fi...

CVE-2020-25717

CVE-2020-25717 affects Samba: an authenticated user mapping domain users to local users can lead to privilege escalation. Public references in Connected documents confirm this is a Samba issue (no exploit details provided here). Several advisories and vendor notes indicate patches or updated pack...

CVE-2016-2124

CVE-2016-2124 is a Samba SMB1 authentication flaw. The vulnerability lets an attacker retrieve plaintext passwords sent over the wire, even when Kerberos may be required. Connected sources confirm Samba SMB1 handling is at issue, with advisories across Red Hat, Amazon Linux 2/ALAS, Alpine and Clo...

CVE-2015-1867

CVE-2015-1867 affects Pacemaker up to version 1.1.13. The flaw arises when evaluating added nodes, enabling remote read-only users to gain privileges via an acl command. MiracleLinux advisories and other Nessus plugins link this CVE to Pacemaker releases up to 1.1.13 (and fixes in that version). ...

CVE-2016-7797

CVE-2016-7797 affects Pacemaker prior to 1.1.15. The issue can allow a remote, unauthenticated attacker (via pacemaker remote) to cause a denial of service resulting in node disconnection. The connected sources corroborate the high-level impact and reference related advisories (e.g., RHSA-2016:25...

CVE-2015-1848

The CVE-2015-1848 entry concerns the PCS daemon (pcsd) in PCS 0.9.137 and earlier failing to set the Secure flag on cookies in HTTPS sessions (CVE-2015-1848); CVE-2015-3983 covers the related issue of not setting the HttpOnly flag. Multiple open-source advisories (Fedora/CentOS and related feeds)...