Steam Profile Integration version 2.0.11 suffers from a remote SQL injection vulnerability.
Monthly Archives: March 2017
GitHub Enterprise 2.8.x Remote Code Execution
GitHub Enterprise versions 2.8.x prior to 2.8.6 suffer from a remote code execution vulnerability.
USB Pratirodh XXE Injection
USB Pratirodh suffers from an XML external entity injection vulnerability.
Skype 7.16.0.102 DLL Hijacking
Skype version 7.16.0.102 suffers from a dll hijacking vulnerability.
Ubuntu Security Notice USN-3234-2
Ubuntu Security Notice 3234-2 – USN-3234-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Ralf Spenneberg discovered that the ext4 implementation in the Linux kernel did not properly validate meta block groups. An attacker with physical access could use this to specially craft an ext4 image that causes a denial of service. Various other issues were also addressed.
Ubuntu Security Notice USN-3234-1
Ubuntu Security Notice 3234-1 – Ralf Spenneberg discovered that the ext4 implementation in the Linux kernel did not properly validate meta block groups. An attacker with physical access could use this to specially craft an ext4 image that causes a denial of service. It was discovered that the Linux kernel did not clear the setgid bit during a setxattr call on a tmpfs filesystem. A local attacker could use this to gain elevated group privileges. Various other issues were also addressed.
drupal8-8.2.7-1.fc25
[8.2.7](https://www.drupal.org/project/drupal/releases/8.2.7) ([SA-CORE-2017-001](https://www.drupal.org/SA-2017-001))
drupal8-8.2.7-1.fc24
[8.2.7](https://www.drupal.org/project/drupal/releases/8.2.7) ([SA-CORE-2017-001](https://www.drupal.org/SA-2017-001))
drupal8-8.2.7-1.fc26
[8.2.7](https://www.drupal.org/project/drupal/releases/8.2.7) ([SA-CORE-2017-001](https://www.drupal.org/SA-2017-001))
CVE-2017-3831
A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. The vulnerability is due to improper implementation of authentication for accessing certain web pages using the GUI interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface of the affected system. A successful exploit could allow the attacker to bypass authentication and perform unauthorized configuration changes or issue control commands to the affected device. This vulnerability affects Cisco Mobility Express 1800 Series Access Points running a software version prior to 8.2.110.0. Cisco Bug IDs: CSCuy68219.