Threat Landscape for Industrial Automation Systems in H1 2018

For many years, Kaspersky Lab experts have been uncovering and researching cyberthreats that target a variety of information systems – those of commercial and government organizations, banks, telecoms operators, industrial enterprises, and individual users. In this report, Kaspersky Lab Industria...

Google Chrome PDFium memory misreference vulnerability (CNVD-2018-22401)

Google Chrome is the United States Google Google company developed a Web browser. PDFium is one of the open source PDF rendering engine. A memory misreference vulnerability exists in PDFium in Google Chrome prior to 63.0.3239.84. A remote attacker can exploit this vulnerability to cause heap dama...

DEBIAN-CVE-2018-16510

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact...

Windows GDI Disclosure

The vulnerability of the Windows GDI component in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created document or a specially...

Windows GDI Disclosure

The vulnerability of the Windows GDI component in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created document or a specially...

Windows GDI Disclosure

The vulnerability of the Windows GDI component in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created document or a specially...

CVE-2018-14902

The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read scanned documents...

CVE-2018-14902

The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read scanned documents...

PT-2018-12787

Name of the Vulnerable Software and Affected Versions EPSON iPrint application version 6.6.3 Description The issue concerns improper data access restriction in the ContentProvider of the EPSON iPrint application. This allows an attacker's application to read scanned documents. Recommendations For...

CVE-2018-14902: Exposure of Sensitive Information to an Unauthorized Actor

The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read scanned documents...

Crashing Mobile Apps Capture Screens, Leak Private Data

Several mobile software developer kits SDKs can capture sensitive user data when a mobile app crashes, exposing private data to an outside third party. Researchers at Appthority singled out SDKs offered by AppSee and TestFairy in a report published Monday. They warned that mobile users whose apps...

Cross site scripting

An issue was discovered in inc/classfeedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can generate a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15. The thread titles within title elements of the generated XML documents aren't sanitized, leading to...

Red Hat JBoss Core Services libxml2 Denial of Service Vulnerability (CNVD-2018-15905)

Red hat JBoss Core Services is the United States Red Hat Red Hat, Inc. provides a variety of intermediate section of the tool set. libxml2 is the GNOME project team developed a C-based language used to parse XML documents library, which supports a variety of encoding formats, Xpath parsing,...

CVE-2018-1000632: XML Injection (aka Blind XPath Injection)

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or...

New Trickbot Variant Touts Stealthy Code-Injection Trick

Trickbot has been around since 2016 – but a new variant of the infamous financial trojan has caught the eyes of researchers with a stealthy code-injection technique. Researchers at Cyberbit this week said that they have found a new Trickbot iteration that features a sneaky method of performing...

CVE-2018-14316

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-14316

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-14292

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14289

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-14307

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...