CVE-2018-10190

CVE-2018-10190 concerns London Trust Media Private Internet Access (PIA) VPN Client for Windows v77. The issue is a local privilege escalation caused by insufficient access controls: using the system tray’s Changelog/Help context menu can spawn an elevated instance of the user’s default browser, ...

CVE-2018-10190

A vulnerability in London Trust Media Private Internet Access PIA VPN Client v77 for Windows could allow an unauthenticated, local attacker to run executable files with elevated privileges. The vulnerability is due to insufficient implementation of access controls. The "Changelog" and "Help"...

CVE-2018-0532

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors...

Microsoft Office: ActiveX Control Initialization

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013activexcontrolinitialization.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for ActiveX Control Initialization Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net...

Microsoft Office: Load Controls in Forms3

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013loadcontrolsform3.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Load Controls in Forms3 Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...

Yokogawa CENTUM and Exaopc

1. EXECUTIVE SUMMARY CVSS v3 6.5 Vendor : Yokogawa Equipment : CENTUM series and Exaopc Vulnerability : Permissions, Privileges, and Access Controls 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local attacker to generate false system or process alarms, or block...

CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure Vulnerability

Exploit for linux platform in category dos / poc Advisory: CyberArk Password Vault Memory Disclosure Data in the CyberArk Password Vault may be accessed through a proprietary network protocol. While answering to a client's logon request, the vault discloses around 50 bytes of its memory to the...

The vulnerability of Siemens EN100 Ethernet module’s microprogramming software, related to access control deficiencies, allows attackers to install their own microprogramming software.

The vulnerabilities of microprogramming software for communication modules such as EN100 Ethernet module IEC 61850, EN100 Ethernet module PROFINET IO, EN100 Ethernet module DNP3, EN100 Ethernet module Modbus TCP, and EN100 Ethernet module IEC 104 are related to access control deficiencies...

Maybe you shouldn’t use LinkedIn

UPDATE: 4/6/2018 LinkedIn reached out for comment on the article, and we'd like to clarify our position based on their concerns. They wrote: Members control their connections, who can see them including keeping them private if they wish and only first degree connections can get access to your...

Incorrect Access Controls

koji uses incorrect access controls. This vulnerability allows attackers to read and write arbitrary files within the filesystem...

MGASA-2018-0191 Updated php packages fix security vulnerability

Dumpable FPM child processes allow bypassing opcache access controls php75605...

Updated php packages fix security vulnerability

Dumpable FPM child processes allow bypassing opcache access controls php75605...

CVE-2018-4115

An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves CFPreferences in the "System Preferences" component. It allows attackers to bypass intended access...

PT-2018-18916 · Openresty · Openresty

Name of the Vulnerable Software and Affected Versions: OpenResty versions 1.13.6.1 and earlier Description: The issue arises from how OpenResty obtains URI parameters using the ngx.req.get uri args and ngx.req.get post args functions, which ignore parameters beyond the hundredth one. This might...

PT-2018-1287 · Igor Pavlov · 7-Zip

Name of the Vulnerable Software and Affected Versions: 7-Zip versions prior to 18.02 Description: The issue is related to the implementation of the "Large memory pages" option in 7-Zip, which uses the LsaAddAccountRights function to add the SeLockMemoryPrivilege privilege to the user's account...

CVE-2017-9681

In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if kernel memory address is passed from userspace through irisvidiocsextctrls ioctl, it will print kernel address data. A user could set it to an arbitrary kern...

Incorrect Access Controls

github.com/cloudfoundry/silk-release has incorrect access controls. If an application has an application security group ASG which overlaps with the Silk overlay network, applications are able to access other applications on the network ignoring the configured routing policies...

Incorrect Access Controls

github.com/cloudfoundry/bosh-cli uses incorrect access controls. If a user has access to an instance, they can use the contents of the BOSH CLI configuration file to perform authenticated requests to BOSH...

HPSBHF03581 rev. 4 - AMD Secure Processor and Promontory Chipset Exploits

Potential Security Impact Circumvention of platform security controls, unauthorized access to system memory, installation of difficult to detect malware. Source: CTS Reported By: CTS VULNERABILITY SUMMARY Vulnerability | Description | Impact ---|---|--- MASTERKEY | Attacker who already has...

Investors concerned about smartphone addiction; Apple responds with new webpage

Hot on the heels of an open letter from investors urging Apple to do more to protect children from smartphone addiction, the tech giant has recently dedicated a page on their website to families. The "Families" page, which can be accessed at apple.com/families, contains tools parents can use to s...