Archive
22 April 2019
Vulnerabilities first published on this day (UTC), newest first.
14 results · Clear filters · Feed
-
Medium 6.1
Cross-site Scripting in Eclipse Jetty
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a List…
-
Medium 5.3
Installation information leak in Eclipse Jetty
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error …
-
Medium 5.3
Information Exposure vulnerability in Eclipse Jetty
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. T…
-
Medium 5.5
Probe-and-enlist for SeaMicro chassis writes password to the log
The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
-
Medium 6.4
Juju Joyent provider uploads user's private ssh key by default
Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
-
Medium 5.7
python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
-
Medium 6.7
UDM doesn't check for confinement before running post-processing commands
UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confine…
-
Medium 4.8
Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash
Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a scope.
-
Medium 5.7
Ekiga attempts to dlopen /tmp/ekiga_test.so
Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekiga_test.so.
-
Medium 5.2
SELinux initscript misuse of touch
The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.
-
Medium 5.1
Mercurial Path Traversal/Link Following vulnerability
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
-
Medium 5.6
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…
-
Medium 4.1
A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM B…
-
Medium 6.5
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data captur…