CVE-2018-10403

An issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but t...

CVE-2018-10403

CVE-2018-10403 affects F-Secure XFENCE and Little Flocker, describing a vulnerability where a maliciously crafted Universal/Fat binary can bypass third-party code-signing checks, causing unsigned code to execute while appearing signed by Apple. Root cause: improper handling of multi-architecture ...

CVE-2018-10403: Improper Certificate Validation

An issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but t...

PT-2018-9867

Name of the Vulnerable Software and Affected Versions: F-Secure XFENCE and Little Flocker affected versions not specified Description: A maliciously crafted Universal/fat binary can evade third-party code signing checks. This occurs because the tool does not complete a full inspection of the...

PT-2018-10975

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue allows for Arbitrary File Read via the f parameter in the "img.php" endpoint. This is achieved through absolute path traversal, enabling...

CVE-2018-12054: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

Multiple F-Secure Internet Gatekeeper Products Information Disclosure Vulnerabilities

F-Secure Internet Gatekeeper is an antivirus product released by a Finnish antivirus vendor. An information disclosure vulnerability exists in several F-Secure Internet Gatekeeper products. An attacker could obtain sensitive information and launch other attacks...

PT-2018-10964

Name of the Vulnerable Software and Affected Versions Roxy Fileman versions prior to 1.4.6 Description The issue allows for directory traversal via the "f" parameter in the php/download.php endpoint. Recommendations For Roxy Fileman versions prior to 1.4.6, update to version 1.4.6 or later to...

CVE-2018-12042: Improper Limitation of a Pathname to a Restricted Directory

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter...

CVE-2018-11493: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add...

Microsoft Windows Kernel 'Win32k.sys' Local Privilege Escalation Vulnerability(CVE-2018-8120)

作者：bigric3 作者博客： 5月15日ESET发文其在3月份捕获了一个 pdf远程代码执行（cve-2018-4990）+windows本地权限提升（cve-2018-8120）的样本。ESET发文后，我从vt上下载了这样一份样本（）。初步逆向，大致明确如外界所传，该漏洞处于开发测试阶段，不慎被上传到了公网样本检测的网上，由ESET捕获并提交微软和adobe修补。测试特征字符串如下 定位样本中关键的代码并调试分析...

WUZHI CMS 4.1.0 - tag[pinyin] Cross-Site Scripting

WUZHI CMS 4.1.0 - tagpinyin Cross-Site Scripting Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10311 An...

GNU Wget 1.19.4 Cookie Injection

GNU Wget Cookie Injection CVE-2018-0494 ========================================= The latest version of this advisory is available at: https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt Overview -------- GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to th...

GNU wget - Cookie Injection

GNU wget - Cookie Injection GNU Wget Cookie Injection CVE-2018-0494 ========================================= The latest version of this advisory is available at: https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt Overview -------- GNU Wget is susceptible to a malicious web server...

Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-10113)

F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. A security vulnerability exists in several F5 products. When Large Receive Offload and SYN cookies are turned on, an attacker can exploit the...

Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-10114)

F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. A security vulnerability exists in several F5 products. When Large Receive Offload and SYN cookies are turned on, an attacker can exploit the...

Cross site scripting

A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...

CVE-2018-10311

A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...

CVE-2018-10313: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq10%5D parameter to the /index.php?m=member&f=index&v=profile&setiframe=1 URI...

PT-2019-13820

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.16.4 Description A double-locking error in the Linux kernel may potentially cause a deadlock. The issue is related to the f hid function in drivers/usb/dwc3/gadget.c. Recommendations For versions prior to 4.16....