DEBIAN-CVE-2017-11746

Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tenshi.pid modification before a root script executes a "kill cat /pathname/tenshi.pid" command...

DEBIAN-CVE-2017-11747

main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a...

AudioCoder 0.8.46 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title : AudioCoder 0.8.46 Local Buffer Overflow SEH CVE : CVE-2017-8870 Exploit Author : Muhann4d @0xSecured Vendor Homepage : http://www.mediacoderhq.com Vulnerable Software:...

PT-2017-4024

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 56 Description The issue is related to the browser's behavior when web content is dragged onto certain parts of the browser UI, such as the tab bar. This can lead to the opening of links that would otherwise be...

Information Disclosure

moodle/moodle is vulnerable to information disclosure attacks. theme/yuicombo.php doesn't correctly construct errors for the drag-and-drop script. Attackers can use this flaw to obtain the installation path through requests for nonexistent resources...

CVE-2017-4901

The drag-and-drop DnD function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability. This may allow a guest to execute code on the operating system that runs Workstation or Fusion...

PT-2017-2232

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 12.x through 12.5.3 VMware Fusion versions 8.x through 8.5.4 Description The issue is related to an out-of-bounds memory access vulnerability in the drag-and-drop function of VMware Workstation and Fusion. This...

CVE-2017-4901: Improper Restriction of Operations within the Bounds of a Memory Buffer

The drag-and-drop DnD function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability. This may allow a guest to execute code on the operating system that runs Workstation or Fusion...

CVE-2017-5458

When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. This vulnerability affects Firefox 53...

UBUNTU-CVE-2017-5458

When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. This vulnerability affects Firefox 53...

PT-2017-16514

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 53 ALT Linux affected versions not specified Description The issue allows for users to be socially engineered into executing an XSS attack on themselves. This occurs when a "javascript:" URL is drag and dropped by a...

CVE-2017-2378

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during...

Code injection

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during...

CVE-2017-2378

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during...

UBUNTU-CVE-2017-2378

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during...

CVE-2017-2378

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during...

CVE-2017-2378

CVE-2017-2378 affects WebKit in Apple iOS and Safari prior to updates: iOS < 10.3 and Safari

PT-2017-1764

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.3 Safari versions prior to 10.1 Description The issue involves mishandling of links during drag-and-drop actions in the WebKit component, allowing remote attackers to execute arbitrary code or spoof a bookmark. This is...

CVE-2017-2378: Improper Input Validation

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during...

VMware Player 12.x < 12.5.4 Drag-and-Drop Feature Guest-to-Host Code Execution (VMSA-2017-0005) (Linux)

The version of VMware Player installed on the remote Linux host is 12.x prior to 12.5.4. It is, therefore, affected by a guest-to-host arbitrary code execution vulnerability in the drag-and-drop DND functionality due to an out-of-bounds memory access error. An attacker within a guest can exploit...