Security News

CVE-2017-1000245

National Vulnerability Database - Wed, 11/01/2017 - 09:29
The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.
Categories: Security News

CVE-2017-12625

National Vulnerability Database - Wed, 11/01/2017 - 09:29
Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.
Categories: Security News

Bugtraq: APPLE-SA-2017-10-31-12 Additional information for APPLE-SA-2017-09-25-9 macOS Server 5.4

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 09:20
APPLE-SA-2017-10-31-12 Additional information for APPLE-SA-2017-09-25-9 macOS Server 5.4
Categories: Security News

Bugtraq: APPLE-SA-2017-10-31-11 Additional information for APPLE-SA-2017-09-20-3 tvOS 11

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 09:20
APPLE-SA-2017-10-31-11 Additional information for APPLE-SA-2017-09-20-3 tvOS 11
Categories: Security News

Bugtraq: APPLE-SA-2017-10-31-10 Additional information for APPLE-SA-2017-09-20-2 watchOS 4

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 09:20
APPLE-SA-2017-10-31-10 Additional information for APPLE-SA-2017-09-20-2 watchOS 4
Categories: Security News

Bugtraq: APPLE-SA-2017-10-31-9 Additional information for APPLE-SA-2017-09-19-1 iOS 11

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 09:20
APPLE-SA-2017-10-31-9 Additional information for APPLE-SA-2017-09-19-1 iOS 11
Categories: Security News

More rss feeds from SecurityFocus

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 09:20
News, Infocus, Columns, Vulnerabilities, Bugtraq ...
Categories: Security News

Vuln: Apache Traffic Server CVE-2015-3249 Multiple Remote Code Execution Vulnerabilities

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 00:00
Apache Traffic Server CVE-2015-3249 Multiple Remote Code Execution Vulnerabilities
Categories: Security News

Vuln: GNU Wget CVE-2016-7098 Security Bypass Vulnerability

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 00:00
GNU Wget CVE-2016-7098 Security Bypass Vulnerability
Categories: Security News

Vuln: Apache Traffic Server CVE-2014-3624 Access Bypass Vulnerability

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 00:00
Apache Traffic Server CVE-2014-3624 Access Bypass Vulnerability
Categories: Security News

Vuln: HP ArcSight ESM and ArcSight ESM Express CVE-2017-14356 SQL Injection Vulnerability

SecurityFocus Vulnerabilities - Wed, 11/01/2017 - 00:00
HP ArcSight ESM and ArcSight ESM Express CVE-2017-14356 SQL Injection Vulnerability
Categories: Security News

CVE-2017-14021

National Vulnerability Database - Tue, 10/31/2017 - 22:29
A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNet5628G-R version 1.4, JetNet5628G version 1.4, JetNet5728G-24P version 1.4, JetNet5828G version 1.1d, JetNet6710G-HVDC version 1.1e, and JetNet6710G version 1.1. An attacker may gain access to hard-coded certificates and private keys allowing the attacker to perform man-in-the-middle attacks.
Categories: Security News

CVE-2017-14027

National Vulnerability Database - Tue, 10/31/2017 - 22:29
A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNet5628G-R version 1.4, JetNet5628G version 1.4, JetNet5728G-24P version 1.4, JetNet5828G version 1.1d, JetNet6710G-HVDC version 1.1e, and JetNet6710G version 1.1. The software uses undocumented hard-coded credentials that may allow an attacker to gain remote access.
Categories: Security News

CVE-2017-16248

National Vulnerability Database - Tue, 10/31/2017 - 21:29
The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.
Categories: Security News

CVE-2017-14375

National Vulnerability Database - Tue, 10/31/2017 - 21:29
EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtual Appliance versions prior to 8.4.0.512, and EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier) contain an authentication bypass vulnerability that may potentially be exploited by malicious users to compromise the affected system.
Categories: Security News

CVE-2017-14376

National Vulnerability Database - Tue, 10/31/2017 - 21:29
EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise the affected system.
Categories: Security News

CVE-2017-15535

National Vulnerability Database - Tue, 10/31/2017 - 21:29
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.
Categories: Security News

CVE-2017-16244

National Vulnerability Database - Tue, 10/31/2017 - 21:29
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.
Categories: Security News

CVE-2017-1000257

National Vulnerability Database - Tue, 10/31/2017 - 17:29
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
Categories: Security News

CVE-2017-1000382

National Vulnerability Database - Tue, 10/31/2017 - 16:29
VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.
Categories: Security News

Pages