2826 matches found
Microsoft Windows Multiple Vulnerabilities (KB4338815)
This host is missing a critical security update according to Microsoft KB4338815 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Microsoft Windows Multiple Vulnerabilities (KB4338825)
This host is missing a critical security update according to Microsoft KB4338825 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2018-8288
CVE-2018-8288 is a remote code execution vulnerability in ChakraCore, Internet Explorer 11, and Microsoft Edge caused by memory handling of objects in the scripting engine (memory corruption). The CVE notes high impact with network access and required user interaction. Public references in the co...
CVE-2018-8291
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-8242,...
PT-2018-18532 · Microsoft · Browsers +2
Name of the Vulnerable Software and Affected Versions: Microsoft browsers affected versions not specified Description: A remote code execution issue exists in the way the scripting engine handles objects in memory in Microsoft browsers. This could corrupt memory, allowing an attacker to execute...
PT-2018-18533 · Microsoft · Browsers +2
Name of the Vulnerable Software and Affected Versions: Microsoft browsers affected versions not specified Description: A remote code execution issue exists in the way the scripting engine handles objects in memory in Microsoft browsers. This could corrupt memory, allowing an attacker to execute...
Most LokiBot samples in the wild are "hijacked" versions of the original malware
Hacker himself got hacked. It turns out that most samples of the LokiBot malware being distributed in the wild are modified versions of the original sample, a security researcher has learned. Targeting users since 2015, LokiBot is a password and cryptocoin-wallet stealer that can harvest...
U.S. Dept Of Defense: █████ - DOM-based XSS
Greetings, I've discovered a DOM-based XSS at ██████ Proof of concept: 1. Go to https://███/█████/home/troubleshoot.html?lang=en&returnUrl=https://█████/███████/home/signin.html?returnUrl=https%3A//████/██████████/home/user.html 2. In the username field, add the following code:...
Remote Code Execution (RCE)
Microsoft ChakraCore is vulnerable to remote code execution. This is due to the way Microsoft browsers access objects in memory which results in memory corruption...
Microsoft Windows 10: Consumer Microsoft account user authentication
When enabled, this policy will prevent all applications and services on the device from new consumer Microsoft account authentication via the Windows OnlineID and WebAccountManager APIs. This policy may not affect applications which have already authenticated until the authentication cache expire...
Google Home and Chromecast Design Vulnerabilities
Google Home and Chromecast are both products of Google Inc. Google Home is a smart speaker device and Chromecast is an Internet TV set-top box device. There is a security vulnerability in the API services in Google Home and Chromecast. A remote attacker could use this vulnerability to determine t...
Cross site request forgery (csrf)
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scanresults JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its...
Multiple Web Browsers Security Feature Bypass Information Disclosure (CVE-2018-8235)
A vulnerability was discovered within multiple web browsers that could allow security feature bypass. The vulnerability could allow an attacker to bypass the Same Origin Policy. Successful exploitation could force the browser to send data that would otherwise be restricted...
Security Bulletin: Vulnerability in SSLv3 affects IBM Virtualization Engine TS7700 (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Virtualization Engine TS7700. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain...
[SECURITY] Fedora 27 Update: nodejs-uri-js-4.2.2-2.fc27
URI.js is an RFC 3986 compliant, scheme extendable URI parsing/validating/resolving library for all JavaScript environments browsers, Node.js, etc...
Microsoft Patch Tuesday, June 2018 Edition
Microsoft today pushed out a bevy of software updates to fix more than four dozen security holes in Windows and related software. Almost a quarter of the vulnerabilities addressed in this month's patch batch earned Microsoft's "critical" rating, meaning malware or miscreants can exploit the flaws...
June Patch Tuesday – New Speculative Store Bypass Fixes, Adobe Vulns
June's Patch Tuesday is lighter weight compared to previous months. In all, 51 unique CVEs are addressed, with 11 CVEs marked as Critical. Adobe also released an out-of-band update for a Flash Player vulnerability last week, which is being actively exploited. Speculative Store Bypass Microsoft...
KLA11265 Multiple vulnerabilities in Microsoft Internet Explorer & Edge
Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability in Chakra Scripting...
CVE-2017-16224
st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...