Google Android HTC bootloader elevation of privilege vulnerability (CNVD-2017-32979)

Android is a free and open-source Linux-based operating system for mobile devices such as smartphones and tablets, led and developed by Google Inc. and the Open Handset Alliance. The Android HTC bootloader has a security vulnerability that allows an attacker to exploit the vulnerability to submit...

Vulnerabilities include the browser of the event log, settings of distributed switches, and the content library of the management server for virtual infrastructure VMware vCenter Server, which allows attackers to access confidential information.

The vulnerability of the event log browser, distributed switch configuration settings, and the content library of the VMware vCenter Server management server is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to...

F5 BIG-IP systems Traffic Management Microkernel Denial of Service Vulnerability

F5 BIG-IP systems is an application delivery product that integrates network traffic management, application security management, and load balancing. A security vulnerability in the F5 BIG-IP systems Traffic Management Microkernel could be exploited by remote attackers to submit specially crafted...

Microsoft Edge scripting engine memory corrupted code execution vulnerability

Microsoft Edge is a web browser developed by Microsoft Corporation in the United States. A memory corruption vulnerability exists in the Microsoft Edge scripting engine, which allows remote attackers to exploit the vulnerability by submitting a specially crafted request that crashes the applicati...

The vulnerability of the Advantech WebAccess remote monitoring software lies in its authentication procedures’ flaws, which allow a malicious actor to execute arbitrary code.

The vulnerability of the Advantech WebAccess remote monitoring software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created requests...

httpd: Uninitialized memory reflection in mod_auth_digest

It was discovered that the httpd's modauthdigest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to...

Microsoft Windows Kernel 'Win32k.sys' Information Disclosure Vulnerability

Microsoft Windows is a popular operating system. A security vulnerability in Microsoft Windows 'Win32k.sys' handling of memory objects allows local attackers to exploit the vulnerability to submit specially crafted requests for sensitive information...

Microsoft SharePoint Foundation Cross-Site Scripting Vulnerability (CNVD-2017-32621)

Microsoft SharePoint Foundation is the United States Microsoft Microsoft company's set of Web-based collaboration platform for small organizations or departments. A cross-site scripting vulnerability exists in Microsoft SharePoint Foundation 2013 SP1, which originates from the program failing to...

Apache Struts2 Freemarker Remote Code Execution (CVE-2017-12611)

A remote code execution vulnerability exists in the Apache Struts2 using Freemarker template engine. An attacker could exploit this vulnerability by sending crafted requests to the target host. Successful exploitation could result in execution of arbitrary code on the affected system...

tomcat: Security constrained bypass in error page mechanism

A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page...

ARM mbed TLS Authentication Bypass Vulnerability

ARM mbed TLS is a product that provides secure communication and encryption capabilities for mbed products. A security vulnerability exists in ARM mbed TLS that allows remote attackers to submit specially crafted requests to bypass authentication and gain unauthorized access...

DEBIAN-CVE-2017-11610

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups...

Code Execution Vulnerability in ideacms v2.0.7

IdeaCMS website management system is by the three skin network technology limited company the original day side of the network based on the Asp + Access/Mssql environment to develop a rapid station-building system. Code execution vulnerability exists in ideacms v2.0.7. The vulnerability is due to...

Cisco Unified Communications Manager Elevation of Privilege Vulnerability

Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. An elevation of privilege...

The vulnerability of the web-server module that implements Intel Active Management Technology, a remote control technology for computers, allows attackers to gain access to the device.

The vulnerability of the web-server module that implements Intel Active Management Technology for remote control involves deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device by sending specially...

Cisco Application Policy Infrastructure Controller Elevation of Privilege Vulnerability

The Cisco Application Policy Infrastructure Controller is Cisco's robust all-in-one architecture for transport networks. A security vulnerability in the Cisco Application Policy Infrastructure Controller RBAC privilege assignment allows remote attackers to exploit the vulnerability by submitting...

Xen maptrack release list handling memory corruption vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A memory corruption vulnerability exists in the Xen maptrack release list handling, which allows an attacker to exploit the vulnerability by submitting a specially crafted request...

libsoup: Stack based buffer overflow with HTTP Chunked Encoding

A stack-based buffer overflow flaw was discovered within the HTTP processing of libsoup. A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server functionality or by...

Microsoft Volume Manager Extension Driver Local Information Disclosure Vulnerability

Microsoft Windows is the popular operating system. A security vulnerability in the implementation of the Microsoft Windows Volume Manager Extension Driver allows attackers to exploit the vulnerability by submitting a special request, which can be used to obtain sensitive information...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6.5 Advanced Update Support and Red Hat Enterprise Linux 6.5 Telco Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...