KLA11703 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability i...

PT-2020-1328

Name of the Vulnerable Software and Affected Versions Internet Explorer affected versions not specified Description The issue is related to errors in processing objects in memory. It allows a remote attacker to execute arbitrary code using a specially crafted web page. The vulnerability could...

CVE-2020-0640: Out-of-bounds Write

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'...

Microsoft Internet Explorer CVE-2020-0640 Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Internet Explor...

KLA11638 ACE vulnerability in Microsoft Browsers

Unspecified vulnerability was found in Internet Explorer. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2020-0640 Exploitation Related products Microsoft-Internet-Explorer CVE list CVE-2020-0640 critical KB list 4534306 4534276 4534271 4534293...

Security Updates for Internet Explorer (January 2020)

The Internet Explorer installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in su...

KB4534293: Windows 10 Version 1803 January 2020 Security Update

The remote Windows host is missing security update 4534293. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could...

KB4534309: Windows 8.1 and Windows Server 2012 R2 January 2020 Security Update

The remote Windows host is missing security update 4534309 or cumulative update 4534297. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory. An attacker who successfully...

KB4534271: Windows 10 Version 1607 and Windows Server 2016 January 2020 Security Update

The remote Windows host is missing security update 4534271. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Windows Remote Desktop Gateway RD Gateway when an unauthenticated attacker connects to the target system using RDP and sends...

Cryptic Rumblings Ahead of First 2020 Patch Tuesday

Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows. Those sources say Microsoft has quietly shipped a patch for the bug to...

CVE-2019-18652

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...

Design/Logic Flaw

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...

CVE-2019-18652: Improper Neutralization of Input During Web Page Generation

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...

Xiaozhi Dual Core Browser suffers from dll hijacking vulnerability

Xiaozhi Duo Browser, a secure dual-core browser with built-in Chromium and IE kernels. Xiaozhi Dual Core Browser suffers from a dll hijacking vulnerability, which can be exploited by attackers to gain server privileges...

Exploring VBO365 backups: Understanding Different Restore Scopes

Challenge You can explore backups in three different scopes: Backup Job , Organization , All organizations. Consider the following organizations added to the Veeam Backup for Microsoft 365 backup infrastructure; each of these organizations uses its own backup repository to store data: Organizatio...

Mapbox: Stored XSS | api.mapbox.com | IE 11 | Styles name

On December 24, 2019, user @renekroka reported a stored XSS injection vulnerability on api.mapbox.com that affected users in Internet Explorer 11. An attacker could store XSS injections on Mapbox servers, and then exploit them in IE11 due to JSON responses not including the X-Content-Type-Options...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum LSF Explorer

Summary There are multiple vulnerabilities in IBMRuntime Environment JavaVersion 8 used by IBM Spectrum LSF Explorer. IBM Spectrum LSF Explorer has addressed the applicable CVEs. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products and...

MIME-Confusion-Attack-on-Midori-Browser

MIME Confusion Attack This PoC describes a MIME confusion att...

Microsoft Issues Out-of-Band Update for SharePoint Bug

UPDATE Microsoft has added a fresh CVE to its security portal, linking it to the existing November security updates the patch itself was already included in the updates, but not specifically named. The CVE describes a vulnerability in SharePoint Server. According to a Microsoft Security Advisory,...

Nsasoft Product Key Explorer name field Denial of Service Vulnerability

Product Key Explorer is a program key display tool. A denial of service vulnerability exists in the name field of Nsasoft Product Key Explorer. The vulnerability is due to improper handling of the length of the name field and can be exploited by an attacker to cause the program to crash...