Envitech Ltd. EnviDAS Ultimate

CVSS v3 8.2 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Envitech Ltd. Equipment: EnviDAS Ultimate Vulnerability: Improper Authentication AFFECTED PRODUCTS The following versions of EnviDAS Ultimate, a web application for environmental monitoring, are affected: EnviDAS...

Arbitrary Account Password Reset Vulnerability in Easy Nurse Android App

Easy Nurse Android App is a mobile nursing application. Easy Nurse Android APP has an arbitrary account password reset vulnerability. An attacker can reset any password by grabbing and modifying the password reset function...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-10951

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-10950

CVE-2017-10950 affects Bitdefender Total Security (bdfwfpf kernel driver). The vulnerability lies in the handling of IOCTL 0x8000E038 where the driver fails to validate the existence of an object before operating on it, enabling a local attacker to execute arbitrary code in the SYSTEM context. Ex...

CVE-2017-10952

CVE-2017-10952 affects Foxit Reader (and related Foxit products) with a vulnerability in the saveAs JavaScript function. The flaw allows writing arbitrary files to attacker-controlled locations and can lead to code execution under the current process, with exploitation requiring user interaction ...

CVE-2017-10951

CVE-2017-10951 affects Foxit Reader 8.x (e.g., 8.3.0.14878) and Foxit PhantomPDF prior to 8.3.2. The vulnerability arises from improper validation of a user-supplied string used in the app.launchURL JavaScript call, enabling an attacker to execute arbitrary code under the current process context....

Unity Editor Remote Code Execution Vulnerability

Unity Editor for Windows is a graphical editor for the Windows platform. A remote code execution vulnerability exists in Unity Technologies Unity Editor for Windows-based platforms. A remote attacker can exploit this vulnerability to execute code...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)

Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

Unfixable Automobile Computer Security Vulnerability

There is an unpatchable vulnerability that affects most modern cars. It's buried in the Controller Area Network CAN: Researchers say this flaw is not a vulnerability in the classic meaning of the word. This is because the flaw is more of a CAN standard design choice that makes it unpatchable...

Unpatchable Flaw in Modern Cars Allows Hackers to Disable Safety Features

Today, many automobiles companies are offering vehicles that run on the mostly drive-by-wire system, which means a majority of car's functions—from instrument cluster to steering, brakes, and accelerator—are electronically controlled. No doubt these auto-control systems make your driving experien...

Directory traversal

Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459...

CVE-2017-10949

Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459...

CVE-2017-10949

Dell Storage Manager 2016 R2.1 is affected by a directory traversal vulnerability in the EmWebsiteServlet doGet method, where user-supplied paths are not properly validated before file operations. This can lead to information disclosure and remote, unauthenticated access, with exploit details sta...

Command injection

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745...

Command injection

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG 12 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544...

Denial of service

Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350...

Command injection

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744...

CVE-2017-11392

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745...

CVE-2017-11393

Trend Micro OfficeScan is affected by a Proxy.php parameter parsing flaw that enables remote code execution via the tr parameter in the Web Console’s Proxy.php. Affected products include OfficeScan 11 and XG (12). The vulnerability allows code execution under the current service context; exploita...