CVE-2017-15110

In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students...

CVE-2017-15110

In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students...

Android NVIDIA Thermal Driver Information Disclosure Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, of which NVIDIA Thermal driver is a temperature control component. An information disclosure vulnerability exists in the NVIDIA Thermal driver in Android, which stems from a lack ...

Server side request forgery (ssrf)

The privateaddresscheck ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery...

Adobe Digital Editions Out-of-Bounds Memory Read Vulnerability (CNVD-2017-37096)

Adobe Digital Editions software offers an engaging way to help you view and manage eBooks and other digital publications. An out-of-bounds memory read vulnerability exists in Adobe Digital Editions versions 4.5.6 and earlier. An attacker could exploit this vulnerability to view memory address...

Adobe Digital Editions Memory Corruption Vulnerability (CNVD-2017-37093)

Adobe Digital Editions software offers an engaging way to help you view and manage eBooks and other digital publications. A memory corruption vulnerability exists in Adobe Digital Editions versions 4.5.6 and earlier. An attacker could exploit this vulnerability to view memory address information ...

Microsoft Windows GDI Component Information Disclosure Vulnerability (CNVD-2017-37116)

Microsoft Windows Server 2016 and others are operating systems released by Microsoft USA. kernel is one of the kernels. An information disclosure vulnerability exists in the kernel component of Microsoft Windows that stems from a failure of the GDI component to properly expose kernel memory...

Information disclosure

Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run a specially crafted application to compromise the user's system, due improperly disclosing kernel memory addresses, aka "Windows GDI Information Disclosure...

UBUNTU-CVE-2017-7830

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...

Windows GDI Information Disclosure Vulnerability

A Win32k information disclosure vulnerability exists when the Windows GDI component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker...

KB4048952: Windows 10 Version 1511 November 2017 Cumulative Update

The remote Windows host is missing security update 4048952. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an...

KB4048955: Windows 10 Version 1709 and Windows Server Version 1709 November 2017 Cumulative Update

The remote Windows host is missing security update 4048955. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an...

CVE-2017-0904

The privateaddresscheck ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery...

BOHEMIA INTERACTIVE a.s.: IDOR to view User Order Information

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Description: There is a...

PayPal Inc #168 - Insufficient Authentication Vulnerability

Document Title: =============== PayPal Inc 168 - Insufficient Authentication Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2091 Release Date: ============= 2017-10-30 Vulnerability Laboratory ID VL-ID: ===================================...

Tweep - An Advanced Twitter Scraping Tool

Tweep is an advanced Twitter scraping tool written in python that allows for scraping Tweets and pictures from Twitter profiles without using Twitter's API. Benefits Some of the benefits of using Tweep vs Twitter API: Fast initial setup Can be used anonymously No rate limitations Can fetch all...

Threat Round Up for Oct 20 - Oct 27

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between October 20 and October 27. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...

GHSA-VXF6-W9MP-95HM Puppet supports use of IP addresses in certnames without warning of potential risks

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address...

Puppet supports use of IP addresses in certnames without warning of potential risks

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address...

[SECURITY] Fedora 27 Update: dnsmasq-2.77-9.fc27

Dnsmasq is lightweight, easy to configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. It can serve the names of local machines which are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with...