Archive
10 January 2018
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
High 8.2
MX series, SRX series: Junos OS: Denial of service vulnerability in Flowd on devices with ALG enabled.
On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashe…
-
High 7.4
Security Bulletin: Junos OS: MAC move limit configured to drop traffic may forward traffic.
QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded will forward traffic instead of dropping traffic. This can lead to denials of services or other unintended conditions. Affected releases are Juniper Networks Junos OS: 1…
-
High 7.8
Junos Space: Local privilege escalation vulnerability in Junos Space
Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges.
-
High 7.0
VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file
Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.
-
High 7.8
lean-ruport allows local users to obtain sensitive information by listing the process
test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
backup-agoddard and backup_checksum have Information Exposure vulnerability
(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the…
-
High 7.8
point-cli allows local users to obtain sensitive information by listing the process
lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
kajam allows local users to obtain sensitive information by listing the process
vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to o…
-
High 7.8
codders-dataset Process Table Local Plaintext Credential Disclosure
(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
Cap-Strap gem for Ruby places credentials on the useradd command line
lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
brbackup exposes database password to unauthorized users
lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
lynx doesn't properly sanitize user input and exposes database password to unauthorized users
The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
-
High 7.8
lawn-login exposes database password to unauthorized users
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
Kcapifony gem for Ruby places database user passwords on the command line
lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, which allows local users to obtain sensitive information by listing the processes.
-
High 7.0
Privilege Escalation in Hibernate Validator
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…
-
High 7.1
Apache Geode gfsh authorization vulnerability
When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE p…
-
High 7.5
Apache Geode OQL method invocation vulnerability
When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user coul…
-
High 8.8
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…
KEV Nov 3, 2021 -
High 7.5
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vu…
-
High 7.8
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…
KEV Nov 3, 2021 -
High 7.5
Improper Certificate Validation in Microsoft .NET Framework components
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature B…
-
High 7.5
ChakraCore RCE Vulnerability
Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka "Scripting Engine Security Feat…