CVE-2018-3750

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

Fedora Update for nodejs-deep-extend FEDORA-2018-636f73964f

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Privilege escalation

On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750...

Improper access control

On Lenovo VIBE mobile phones, improper access controls on the nacserver component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user commonly known as 'rooting' or "jail breaking" a device...

CVE-2017-3750

On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3749...

CVE-2017-3748

On Lenovo VIBE mobile phones, improper access controls on the nacserver component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user commonly known as 'rooting' or "jail breaking" a device...

CVE-2017-3749

CVE-2017-3749 affects Lenovo VIBE phones (Idea Friend Android app). The vulnerability allows private data to be backed up and restored via Android Debug Bridge, enabling tampering that leads to privilege escalation when exploited with CVE-2017-3748 and CVE-2017-3750. Connected sources also descri...

CVE-2017-3750

On Lenovo VIBE phones, the Lenovo Security Android app allows private data to be backed up and restored via Android Debug Bridge, enabling tampering that leads to privilege escalation when exploited with CVE-2017-3748 and CVE-2017-3749. The root cause is described as improper access controls on t...

Back That App Up: Gaining Root on the Lenovo Vibe

In May of 2016, Mandiant’s Red Team discovered a series of vulnerabilities present on Lenovo’s Vibe P1 Android-based mobile device that allow local privilege escalation to the user “root”. Mandiant disclosed these vulnerabilities to Lenovo in May of 2016. Lenovo advised Mandiant that it should wo...

Back That App Up: Gaining Root on the Lenovo Vibe

In May of 2016, Mandiant’s Red Team discovered a series of vulnerabilities present on Lenovo’s Vibe P1 Android-based mobile device that allow local privilege escalation to the user “root”. Mandiant disclosed these vulnerabilities to Lenovo in May of 2016. Lenovo advised Mandiant that it should wo...

Local Root Exploit on Lenovo VIBE Mobile Phones - us

Lenovo Security Advisory: LEN-15823 Potential Impact: Elevation of Privilege Severity: Medium Scope of Impact: Lenovo specific CVE Identifier: CVE-2017-3748, CVE-2017-3749, CVE-2017-3750 Summary Description: Vulnerabilities have been identified on Lenovo VIBE Mobile Phones that allow the user or ...

Cisco Catalyst 2960 and 3750 Series Switches Denial of Service Vulnerability

The Cisco Catalyst 2960 and 3750 Series Switches for IOS are Cisco switches running the Cisco IOS operating system. A denial of service vulnerability exists in the Cisco Catalyst 2960 and 3750 Series Switches for IOS. An attacker could exploit this vulnerability to cause a denial of service...

CVE-2016-3750

CVE-2016-3750 affects Android’s Parcels Framework APIs, specifically libs/binder/Parcel.cpp, where the return value of dup() is not validated. This could allow a local attacker to bypass the OS isolation protections via a crafted application, as described for Android 4.x before 4.4.4, 5.0.x befor...

Mageia: Security Advisory (MGASA-2016-0116)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 22 : webkitgtk4-2.10.4-1.fc22 (2016-d132dbb529)

Update to 2.10.4. Major new features: New HTTP disk cache for the Network Process. IndexedDB support. New Web Inspector UI. Automatic ScreenServer inhibition when playing fullscreen videos. Initial Editor API. - Performance improvements. This update addresses the following vulnerabilities:...

Apple Safari Multiple Vulnerabilities-01 (Sep 2015) - Mac OS X

Apple Safari is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:safari"; ifdescription...

CVE-2015-3750

CVE-2015-3750 concerns WebKit in WebKit-based components (e.g., Apple Safari, WebKit2) where Content Security Policy report requests did not have enforceable HTTP Strict Transport Security (HSTS). The failing behavior allowed a MITM to sniff sensitive data or spoof CSP report data, including cook...

Oracle Solaris Critical Patch Update : july2013_SRU11_1_6_4_0

This Solaris system is missing necessary patches to address a critical security update : - Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite subcomponent: Kernel/VM. The supported version that is affected is 11. Easily exploitable vulnerability requiring logon to...

Cisco Catalyst 3750-X Series Switch Default Credentials Vulnerability (CSCue92286)

The remote Cisco device potentially contains an issue which, due to default credentials on the Cisco Service Module, could allow a local attacker to gain unauthorized root access. TRUSTED...

CVE-2013-3750

CVE-2013-3750 affects Oracle Solaris 11, with a local kernel/VM vulnerability that can affect confidentiality, integrity, and availability via unknown vectors. The core affected component is the Solaris Kernel/VM as described in the CVE entry and Red Hat/NVD references. Exploitation details are n...