UBUNTU-CVE-2017-15056

plxelf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted binary file, as demonstrated by an Invalid Pointer Read in PackLinuxElf64::unpack...

First Android Malware Found Exploiting Dirty COW Linux Flaw to Gain Root Privileges

Nearly a year after the disclosure of the Dirty COW vulnerability that affected the Linux kernel, cybercriminals have started exploiting the vulnerability against Android users, researchers have warned. Publicly disclosed last year in October, Dirty COW was present in a section of the Linux...

CVE-2017-14562

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to an "Error Code 0xe06d7363 starting at wow64!Wow64NotifyDebugger+0x000000000000001d."...

Microsoft Windows Kernel - nt!NtSetIoCompletion nt!NtRemoveIoCompletion Pool Memory Disclosure

Microsoft Windows Kernel - nt!NtSetIoCompletion nt!NtRemoveIoCompletion Pool Memory Disclosure / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1269 We have discovered that the nt!NtRemoveIoCompletion system call handler discloses 4 bytes of uninitialized pool memory to user-mo...

Microsoft Windows Kernel - nt!NtSetIoCompletion / nt!NtRemoveIoCompletion Pool Memory Disclosure

Exploit for windows platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1269 We have discovered that the nt!NtRemoveIoCompletion system call handler discloses 4 bytes of uninitialized pool memory to user-mode clients on 64-bit platforms. The bug...

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

Security Update for Microsoft PowerPoint 2013 (KB4011069) 64-Bit Edition

A security vulnerability exists in Microsoft PowerPoint 2013 64-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Skype for Business 2015 (KB4011107) 64-Bit Edition

A security vulnerability exists in Skype for Business 2015 64-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft PowerPoint 2016 (KB4011041) 64-Bit Edition

A security vulnerability exists in Microsoft PowerPoint 2016 64-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft Outlook 2013 (KB4011090) 64-Bit Edition

A security vulnerability exists in Microsoft Outlook 2013 64-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Description of the security update for Office 2016: September 12, 2017 (KB4011126)

None None...

Microsoft Edge 38.14393.1066.0 - CInputDateTimeScrollerElement::_SelectValueInternal Out-of-Bounds Read

Microsoft Edge 38.14393.1066.0 - CInputDateTimeScrollerElement::SelectValueInternal Out-of-Bounds Read input:focus transform: scale10; UpdateSelectedthis-arrayatoffset0xB8this-indexatoffset0xD4.ptratindex0, ...; ... The problem is that the index in the PoC has unsigned 32-bit value of 0xffffffff,...

Microsoft Edge textarea.defaultValue Memory Disclosure

Microsoft Edge: textarea.defaultValue memory disclosure CVE-2017-8652 There is a use-after free vulnerability in Microsoft Edge that can lead to memory disclosure. The vulnerability has been confirmed on Windows 10 Enterprise 64-bit OS version 1607, OS build 14393.1198, Microsoft Edge...

Automated DLL Enumerator: rattler

Rattler helps identify which application DLL’s are vulnerable to DLL preloading attacks. In a nutshell, DLL preloading attacks allow you to trick applications into loading and executing malicious DLL’s. DLL preloading attacks can result in escalation of privileges, persistence and RCE in some...

Linux Kernel 4.12 Race Condition Vulnerability

A race condition was found in the Linux kernel versions 3.14-rc1 through 4.12. The race happens between threads of inotifyhandleevent and vfsrename while running the rename operation against the same file. The next slab data or the slab's free list pointer can be corrupted with attacker-controlle...

Axis 2100 Network Camera 2.43 Cross Site Scripting

i?+ Title: Axis 2100 Network Camera 2.43 - Reflected XSS + Credits / Discovery: Nassim Asrir + Author Contact: [email protected] + Author Company: Henceforth + CVE: CVE-2017-12413 Vendor: =============== https://www.axis.com/ Vulnerability Type: =================== Reflected Cross Site Scripting...

Exploit for CVE-2016-0040

CVE-2016-0040 This exploit builds upon SMMRootkit's 32Bit projec...

Security Update for Microsoft Outlook 2013 (KB4011078) 64-Bit Edition

A security vulnerability exists in Microsoft Outlook 2013 64-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Corel PHOTO-PAINT X8 64-bit TIFF Filter Code Execution Vulnerability

Summary A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 version 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific TIFF file to trigger...

Microsoft Internet Explorer 11.0.9600.18617 - 'CMarkup::DestroySplayTree' Memory Corruption

element. The bug was confirmed on IE Version 11.0.9600.18617 Update Version 11.0.40 running on Windows 7 64-bit. I was unable to reproduce it on Windows 10. PoC: ========================================== -- function go setTimeout"window.location.reload",100;...