chrome-js (>=0.1.8, <=0.2.0), cpos (>=0.1.3, <=0.1.9) +26 more potentially affected by CVE-2016-10580 via nodewebkit (>=0.7.5, <=0.11.6)

nodewebkit NPM version =0.7.5, =0.1.8, =0.1.3, =0.1.0, =0.0.1, =0.1.0, =0.0.0, =0.0.1, =0.0.0, =0.0.24, =0.0.6, =1.6.1, =0.0.0, =0.1.0, =1.0.1, =1.0.2 and more Source cves: CVE-2016-10580 Source advisory: OSV:GHSA-GC6C-5V9W-XMHW...

PT-2019-1518

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings Desktop App versions prior to 33.6.6 and 33.9.1 Cisco Webex Productivity Tools versions prior to 33.0.7 Description A vulnerability in the update service could allow an authenticated, local attacker to execute arbitrary...

Cisco Webex Meetings Desktop App < 33.6.4 Command Injection Vulnerability

The version of Cisco Webex Desktop App installed on the remote host is prior to 33.6.4, and thus, is affected by a command injection vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid119888; scriptversion"1.8";...

SRC-2018-0034 : Cisco Webex Meetings Desktop App Update Service DLL Planting Elevation of Privilege Vulnerability

Vulnerability Details: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Webex Meetings Desktop App. An attacker must first obtain the ability to execute low-privileged code on the target system or have valid credentials in order to exploit this...

A week in security (October 22 – 28)

Last week on Malwarebytes Labs, we took a look at some new Mac malware, gave you a roundup of 2018 exploit kits, and dispensed some advice on sextortion scams. We also looked at the Cathay Pacific breach, groaned at the revival of an old browser trick, and explained how voting machines and...

CVE-2018-15442 Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability

A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this...

CVE-2018-15442

CVE-2018-15442 concerns Cisco Webex Meetings Desktop App on Windows. The issue is a command-injection in the Update Service (WebExService) caused by insufficient validation of user-supplied parameters. An authenticated, local attacker could invoke the update command with a crafted argument and ex...

PT-2018-2053

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings Desktop App for Windows affected versions not specified Cisco Webex Productivity Tools for Windows affected versions not specified Description A vulnerability in the update service could allow an authenticated, local...

CVE-2018-15442: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this...

Cisco Releases Security Updates

Cisco has released security updates to address a vulnerability in Cisco Webex Productivity Tools and the Cisco Webex Meetings Desktop App. An attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review the Cisco Security...

CVE-2018-8569

A remote code execution vulnerability exists in the Yammer desktop application due to the loading of arbitrary content, aka "Yammer Desktop Application Remote Code Execution Vulnerability." This affects Yammer Desktop App...

PT-2018-18585

Name of the Vulnerable Software and Affected Versions Yammer Desktop App affected versions not specified Description A remote code execution issue exists due to the loading of arbitrary content. This allows for potential exploitation. Recommendations At the moment, there is no information about a...

CVE-2018-8569: Undefined Security Weakness

A remote code execution vulnerability exists in the Yammer desktop application due to the loading of arbitrary content, aka "Yammer Desktop Application Remote Code Execution Vulnerability." This affects Yammer Desktop App...

KLA11344 ACE vulnerability in Yammer Desktop App

A remote code execution vulnerability was found in Yammer Desktop Application. Malicious users can exploit this vulnerability remotely via specially crafted website to execute arbitrary code. Original advisories CVE-2018-8569 Exploitation Related products Yammer-Desktop-App CVE list CVE-2018-8569...

Telegram leaked IP addresses of its desktop app users

By Waqas The vulnerability affected Telegram’s desktop app for Windows, Mac, and Linux OS. Telegram, a popular privacy-focused instant messaging application, reportedly contained a bug that can leak the IP addresses of users. Known for providing end-to-end encryption, Telegram’s desktop app has...

CVE-2018-0648

Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0648

Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0648

CVE-2018-0648 affects the ChatWork Desktop App for Windows 2.3.0 and earlier: the installer is vulnerable to insecure DLL search path (CWE-427), allowing arbitrary code execution with the installer's user privileges. Root cause is DLL search path handling in the Windows installer. Mitigation: use...

CVE-2018-0648: Untrusted Search Path

Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...