A “Patch for the Meltdown Patch” released out of band Thursday night

The Meltdown/Spectre saga continues… Late Thursday, Microsoft released a patch for Windows 7 and Server 2008 R2 operating systems to resolve CVE-2018-1038. Apparently, this vulnerability was actually introduced by the patches released in January to mitigate the effects of Meltdown. Microsoft did...

Microsoft Fixes Bad Patch That Left Win7, Server 2008 Open to Attack

Microsoft released an out-of-band fix on Thursday for a Windows vulnerability introduced earlier this year as a patch. If exploited, the bug could allow an authenticated attacker to install programs, access stored data or create new accounts with full user rights on Windows 7 and Server 2008 R2...

Advantech WebAccess < 8.1 - webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow

!/usr/bin/python2.7 Exploit Title: Advantech WebAccess 8.1 webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow RCE Date: 03-29-2018 Exploit Author: Chris Lyne @lynerc Vendor Homepage: www.advantech.com Software Link:...

Advantech WebAccess webvrpcs Buffer Overflow

!/usr/bin/python2.7 Exploit Title: Advantech WebAccess 8.1 webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow RCE Date: 03-29-2018 Exploit Author: Chris Lyne @lynerc Vendor Homepage: www.advantech.com Software Link:...

Stop error 0xAB when you log off a Windows Server 2008 session

Stop error 0xAB when you log off a Windows Server 2008 session Symptoms After you install security update KB 4089344, you receive a Stop error 0xAB error message that resembles the following when you log off the computer: SESSIONHASVALIDPOOLONEXIT ab Important If you install a language pack after...

KLA11219 PE vulnerability in Microsoft Products (ESU)

PE vulnerability was found in Microsoft Products Extended Support Update. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2018-1038 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is...

Microsoft Release Patch for Windows 7 and Windows Server 2008 R2 Systems

Microsoft has released security updates to address a vulnerability in Windows 7 x64 and Windows Server 2008 R2 x64 systems. Exploitation of this vulnerability may allow an attacker to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Vulnerability Not...

Stop error 0xAB when you log off a Windows 7 SP1 or Windows Server 2008 R2 SP1 session

Stop error 0xAB when you log off a Windows 7 SP1 or Windows Server 2008 R2 SP1 session Symptoms After you install Monthly Rollup KB4088875 or Security-only update KB 4088878, you receive a Stop error 0xAB error message that resembles the following when you log off the computer:...

Bad Microsoft Meltdown Patch Made Some Windows Systems Less Secure

UPDATE Researcher Ulf Frisk has created a proof-of-concept exploit demonstrating that Microsoft’s January Patch Tuesday update made security matters worse when it comes to memory vulnerabilities associated with Intel’s CPU bug Meltdown. Frisk, a Swedish IT security expert, reported on Tuesday tha...

CPU usage at 100% when you move files in Windows Server 2008

CPU usage at 100% when you move files in Windows Server 2008 Symptoms After installing security update 4041995 or any other recent update that includes srv2.sys, CPU usage may spike up to 100% when you perform any type of SMB activity, such as copying files over the network. The problem is...

SUSE SLED12 Security Update : libid3tag (SUSE-SU-2018:0722-1)

This update for libid3tag fixes the following issues : - CVE-2004-2779 CVE-2017-11551: Fixed id3utf16deserialize in utf16.c, which previously misparsed ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until OOM leading to DoS. bsc1081959...

New Microsoft Bug Bounty Program Looks To Squash The Next Spectre, Meltdown

In the wake of the Meltdown and Spectre flaws, Microsoft has rolled out a new bug bounty program targeting speculative execution side channel vulnerabilities. The limited time program is open until December 31, and offers up to $250,000 for identifying new categories of speculative execution...

Microsoft Video Control Elevation of Privilege Vulnerability

Microsoft Windows Server 2008 R2 SP1 and others are a series of operating systems released by Microsoft Corporation in the U.S. Video Control is one of the video control components. A privilege vulnerability exists in Microsoft Video Control, which stems from the program's failure to properly...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2018-06770)

Microsoft Windows Server 2008 SP2 and others are a series of operating systems from Microsoft Corporation.Windows kernel is one of the operating system kernels. An information disclosure vulnerability exists in Microsoft Windows kernel, which arises from a program's failure to properly filter...

Microsoft Windows GDI elevation of privilege vulnerability (CNVD-2018-06285)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. The Windows Graphics Device Interface GDI is one of the application program interfaces, whose main task is to be responsible for the exchange of information between the system and the graphics program...

phpIP Management 'CVE-2008-0538' Multiple SQL Injection Vulnerabilities

phpIP Management is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by t...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2018-06768)

Microsoft Windows Server 2008 SP2 and others are a series of operating systems from Microsoft Corporation.Windows kernel is one of the operating system kernels. An information disclosure vulnerability exists in Microsoft Windows kernel, which arises from a program's failure to properly filter...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2018-06798)

Microsoft Windows Server 2008 SP2 and others are a series of operating systems from Microsoft Corporation.Windows kernel is one of the operating system kernels. An information disclosure vulnerability exists in Microsoft Windows kernel, which arises from a program's failure to properly filter...

Microsoft Windows Hyper-V Denial of Service Vulnerability (CNVD-2018-06786)

Microsoft Windows Server 2008 SP2 and others are a series of operating systems from Microsoft Corporation USA.Hyper-V Network Switch is one of the network switches. A denial of service vulnerability exists in Microsoft Hyper-V Network Switch, which originates from the program failing to properly...

CVE-2018-0927

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows information...