CVE-2018-13012

Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.12 allows the remote attacker to execute unauthorized code by substituting a forged update...

Mozilla Firefox Code Execution Vulnerability (CNVD-2018-13891)

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox prior to version 61, Firefox ESR prior to...

AXON PBX DLL Hijacking Vulnerability

AXON PBX is a suite of virtual telephone exchange software for use in business environments. The software is mainly used to manage telephone call centers and implements the functions of a telephone exchange in a software way. A DLL hijacking vulnerability exists in AXON PBX version 2.02, which...

Mozilla Firefox ESR Security Advisories (MFSA2018-15, MFSA2018-17) - 01 - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

KLA11271 Multiple vulnerabilities in Mozilla Firefox and Mozilla Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox and Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, cause denial of service and obtain sensitive information. Below is a complete list of...

PT-2018-3037 · Microsoft +3 · Windows 10 +5

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 61 Firefox ESR versions prior to 60.1 Firefox ESR versions prior to 52.9 Thunderbird versions prior to 60 Thunderbird versions prior to 52.9 Description: The issue is related to security setting errors in Firefox,...

mozilla -- multiple vulnerabilities

Mozilla Foundation reports: CVE-2018-12359: Buffer overflow using computed size of canvas element CVE-2018-12360: Use-after-free when using focus CVE-2018-12361: Integer overflow in SwizzleData CVE-2018-12358: Same-origin bypass using service worker and redirection CVE-2018-12362: Integer overflo...

Security Bulletin: Various IBM WebSphere MQ Installers are susceptible to DLL-planting vulnerabilities (CVE-2016-2542 & CVE-2016-4560)

Summary Various IBM WebSphere MQ graphical user interface installers are susceptible to a DLL-planting vulnerability where a malicious DLL, that is present in the Windows search path, could be loaded by the operating system in place of the genuine file. The vulnerability affects Windows executabl...

The vulnerability of the NmAPI.exe executable of the WhatsUp Gold network infrastructure monitoring system allows a perpetrator to gain unauthorized access to the WhatsUp Gold system or execute remote commands.

The vulnerability of the NmAPI.exe executable of the WhatsUp Gold network infrastructure monitoring system is related to insufficient checking of incoming requests. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to the WhatsUp Gold system, disclose sensitive...

FastStone Image Viewer Denial of Service Vulnerability (CNVD-2018-14269)

FastStone Image Viewer is an image viewer that supports image browsing, format conversion, editing and more. A security vulnerability exists in FastStone Image Viewer version 6.2, which originates from the FSViewer.exe program failing to properly handle malformed JPEG files. An attacker can explo...

FastStone Image Viewer Denial of Service Vulnerability (CNVD-2018-14268)

FastStone Image Viewer is an image viewer that supports image browsing, format conversion, editing and more. A security vulnerability exists in FastStone Image Viewer version 6.2, which originates from the FSViewer.exe program failing to properly handle malformed JPEG files. An attacker can explo...

FastStone Image Viewer Denial of Service Vulnerability (CNVD-2018-14264)

FastStone Image Viewer is an image viewer that supports image browsing, format conversion, editing and more. A security vulnerability exists in FastStone Image Viewer version 6.2, which originates from the FSViewer.exe program failing to properly handle malformed JPEG files. An attacker can explo...

FastStone Image Viewer Denial of Service Vulnerability (CNVD-2018-12111)

FastStone Image Viewer is an image viewer that supports image browsing, format conversion, editing and more. A security vulnerability exists in FastStone Image Viewer version 6.2, which originates from the FSViewer.exe program failing to properly handle malformed JPEG files. An attacker can explo...

FastStone Image Viewer Denial of Service Vulnerability (CNVD-2018-14265)

FastStone Image Viewer is an image viewer that supports image browsing, format conversion, editing and more. A security vulnerability exists in FastStone Image Viewer version 6.2, which originates from the FSViewer.exe program failing to properly handle malformed JPEG files. An attacker can explo...

Olympic Destroyer Returns to Target Biochemical Labs

Olympic Destroyer, the threat actor that caused a crippling sabotage attack on the networks supporting this year’s Winter Games in Pyeongchang, South Korea, has resurfaced with a spy campaign – and with a wider target range. The new campaign began last month and is ongoing, employing spear-phishi...

Bring Your Own Land (BYOL) – A Novel Red Teaming Technique

Introduction One of most significant recent developments in sophisticated offensive operations is the use of “Living off the Land” LotL techniques by attackers. These techniques leverage legitimate tools present on the system, such as the PowerShell scripting language, in order to execute attacks...

Security Bulletin: Privilege Escalation / User Impersonation affects IBM Platform LSF and IBM Spectrum LSF

Summary This is to address security vulnerabilities in IBM Spectrum LSF and IBM Platform LSF Load Sharing Facility that could allow a local attacker to impersonate arbitrary users to submit jobs to LSF, and possibly run LSF jobs as root. LSF uses an external authentication framework to secure use...

Security Bulletin: InstallShield and InstallAnywhere vulnerabilities affect IBM Security Guardium Data Redaction (CVE-2016-2542)

Summary Flexera InstallShield could allow a local attacker to gain elevated privileges on the system, caused by an untrusted search path. An attacker could exploit this vulnerability using a Trojan horse DLL in the current working directory of a setup-launcher executable file to gain elevated...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to root privilege escalation (CVE-2015-1900)

Summary IBM InfoSphere Information Server could allow a local user to execute code with root privileges on the engine tier. Vulnerability Details CVEID: CVE-2015-1900 DESCRIPTION: IBM InfoSphere DataStage could allow a local user to bypass security and replace executables with malicious files tha...

Privilege escalation

The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it's available to create an executable file with System privilege by other vulnerable applications...