CVE-2017-0288

Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Windows Graphics Information Disclosure Vulnerability". This...

Serendipity < 2.1.1 Multiple Vulnerabilities

According to its banner, the version of Serendipity running on the remote host is prior to 2.1.1. It is, therefore, affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists in the templates/2k11/admin/category.inc.tpl script due to improper validation of the...

PT-2017-10498 · Microsoft · Windows Gdi +2

Name of the Vulnerable Software and Affected Versions: Windows GDI component affected versions not specified Description: The issue is related to an information disclosure problem where the Windows GDI component improperly discloses its memory contents. This could allow an attacker to obtain...

PT-2017-10495 · Microsoft · Windows Uniscribe +2

Name of the Vulnerable Software and Affected Versions: Windows Uniscribe affected versions not specified Description: The issue is related to an information disclosure problem where Windows Uniscribe improperly discloses the contents of its memory. This could allow an attacker to obtain informati...

PT-2017-10500 · Microsoft · Windows Gdi +2

Name of the Vulnerable Software and Affected Versions: Windows GDI component affected versions not specified Description: The issue allows attackers to obtain sensitive information and affect the system. It is an information disclosure vulnerability that exists when the Windows GDI component...

PT-2017-10496 · Microsoft · Windows Uniscribe +2

Name of the Vulnerable Software and Affected Versions: Windows Uniscribe affected versions not specified Description: The issue allows attackers to obtain sensitive information and affect the system. It is an information disclosure vulnerability that exists when Windows Uniscribe improperly...

PT-2017-10497 · Microsoft · Windows Uniscribe +2

Name of the Vulnerable Software and Affected Versions: Windows Uniscribe affected versions not specified Description: The issue allows attackers to obtain sensitive information and affect the system. It is an information disclosure vulnerability that exists when Windows Uniscribe improperly...

PT-2017-10499 · Microsoft · Windows Gdi +2

Name of the Vulnerable Software and Affected Versions: Windows GDI component affected versions not specified Description: The issue is related to an information disclosure problem where the Windows GDI component improperly discloses its memory contents. This could allow an attacker to obtain...

CVE-2017-1125

IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Force ID: 121340...

Riverbed SteelHead VCX File Read

This module exploits an authenticated arbitrary file read in the log module's filter engine. SteelHead VCX VCX255U version 9.6.0a was confirmed as vulnerable. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Fedora 24 : sane-backends (2017-0f5fe1913f)

CVE-2017-6318 sane-backends: SANENETCONTROLOPTION response packet may contain memory contents of the server fedora-all ---- This update adds the 'skip-adf' option to the avision driver. This let users work around problems on HP ScanJet 82xx/83xx scanners with no automatic document feeder attached...

Xxe

An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser with improper restriction of XML external entity reference, or XXE may allow an attacker to enter malicious input through the...

UBUNTU-CVE-2017-8921

In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan XML. A resource such as a malicious third-party aircraft could exploit this to damage files belonging to...

Atlassian Confluence 6.0.x < 6.0.7 Drafts diff REST Information Disclosure

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 6.0.x prior to 6.0.7. It is, therefore, affected by an information disclosure vulnerability in the Confluence drafts diff REST resource due to making available the page IDs or draft I...

UBUNTU-CVE-2017-8395

The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc return-value check to see if memory had actually been allocated in the bfdgenericgetsectioncontents function. This vulnerability causes...

RHEL 6 : libreoffice (RHSA-2017:0979)

An update for libreoffice is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2017-7209

The dumpsectionasbytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash...

Null pointer dereference

The dumpsectionasbytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash...

Design/Logic Flaw

An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server CMS, formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the...

Design/Logic Flaw

Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page...