CVE-2017-8422

KDE kauth and kdelibs contain a local privilege escalation flaw: a callerID spoof via D-Bus in KAuth and KDELibs can let a non-privileged user gain root. Affected: kde4libs/kdelibs before 4.14.32 and KAuth before 5.34. Impact: local attacker could escalate privileges; no remote/vector details pro...

PT-2017-18579

Name of the Vulnerable Software and Affected Versions smb4k versions prior to 2.0.1 Description The issue allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service. Recommendations For versions prior to 2.0.1, update to version 2.0.1 or...

SUSE-SU-2017:1315-1 Security update for mariadb

This update for mariadb fixes the following issues: - update to MariaDB 10.0.30 GA notable changes: XtraDB updated to 5.6.35-80.0 TokuDB updated to 5.6.35-80.0 PCRE updated to 8.40 MDEV-11027: better InnoDB crash recovery progress reporting MDEV-11520: improvements to how InnoDB data files are...

CVE-2017-8422

A privilege escalation flaw was found in the way kdelibs handled D-Bus messages. A local user could potentially use this flaw to gain root privileges by spoofing a callerID and leveraging a privileged helper application...

CVE-2017-8422

KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app...

openSUSE Security Update : mysql-community-server (openSUSE-2017-555) (Riddle)

This update for mysql-community-server to version 5.6.36 fixes the following issues : These security issues were fixed : - CVE-2016-5483: Mysqldump failed to properly quote certain identifiers in SQL statements written to the dump output, allowing for execution of arbitrary commands bsc1029014 -...

Request KeyChain Access

github.com/docker/docker-credential-helpers requests keychain access for random keys. This is when the credential helper doesn't have a login keychain specified. It then tries to look at every registered keychain...

NVIDIA GeForce Experience Local Code Execution Vulnerability

NVIDIA GeForce Experience is a suite of automatic graphics card update tools from NVIDIA. A local code execution vulnerability exists in NVIDIA Web Helper.exe in NVIDIA GeForce Experience. A local attacker could exploit this vulnerability to execute arbitrary code...

HideMyAss Pro VPN Client 3.3.0.3 Privilege Escalation Vulnerability

HideMyAss Pro VPN client version 3.3.0.3 for OS X suffers from a helper binary com.privax.hmaprovpn.helper local privilege escalation vulnerability. ------------------------------------------------------------------------ Local privilege escalation vulnerability in HideMyAss Pro VPN client v3.x f...

HideMyAss Pro VPN Client for OS X 2.2.7.0 - Local Privilege Escalation

HideMyAss Pro VPN Client for OS X 2.2.7.0 - Local Privilege Escalation Source: https://www.securify.nl/advisory/SFY20170402/multiplelocalprivilegeescalationvulnerabilitiesinhidemyassprovpnclientv2xforosx.html Abstract Multiple local privilege escalation vulnerabilities were found in the helper...

HideMyAss Pro VPN Client 2.2.7.0 Privilege Escalation Vulnerability

HideMyAss Pro VPN client version 2.2.7.0 for OS X suffers from a helper binary HMAHelper local privilege escalation vulnerability. ------------------------------------------------------------------------ Multiple local privilege escalation vulnerabilities in HideMyAss Pro VPN client v2.x for OS X...

HideMyAss Pro VPN Client 3.3.0.3 Privilege Escalation

------------------------------------------------------------------------ Local privilege escalation vulnerability in HideMyAss Pro VPN client v3.x for macOS ------------------------------------------------------------------------ Han Sahin, April 2017...

CVE-2017-6250

NVIDIA GeForce Experience contains a vulnerability in NVIDIA Web Helper.exe, where untrusted script execution may lead to violation of application execution policy and local code execution...

Live Helper Chat 2.58v Cross Site Scripting Vulnerability

Exploit for php platform in category web applications COMPASS SECURITY ADVISORY https://www.compass-security.com/en/research/advisories/ CSNC ID: CSNC-2017-004 Product: Live Helper Chat 1 Vendor: Live Helper Chat Subject: Cross-Site Scripting - XSS Risk: High Effect: Remotely exploitable Author:...

Live Helper Chat 2.58v Cross Site Scripting

COMPASS SECURITY ADVISORY https://www.compass-security.com/en/research/advisories/ CSNC ID: CSNC-2017-004 Product: Live Helper Chat 1 Vendor: Live Helper Chat Subject: Cross-Site Scripting - XSS Risk: High Effect: Remotely exploitable Author: Sylvain Heiniger [email protected]...

Back In Time competitive conditions loophole

Back In Time aka backintime is a suite of Linux backup tools. A competitive condition vulnerability exists in the 'checkPolkitPrivilege' function of the serviceHelper.py file in Back In Time 1.1.18 and earlier versions. An attacker can exploit this vulnerability to replace the user's request...

DEBIAN-CVE-2017-7572

The checkPolkitPrivilege function in serviceHelper.py in Back In Time aka backintime 1.1.18 and earlier uses a deprecated polkit authorization method unix-process that is subject to a race condition time of check, time of use. With this authorization method, the owner of a process requesting a...

Debian DSA-3823-1 : eject - security update

Ilja Van Sprundel discovered that the dmcrypt-get-device helper used to check if a given device is an encrypted device handled by devmapper, and used in eject, does not check return values from setuid and setgid when dropping privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

codeigniter -- multiple vulnerabilities

The CodeIgniter changelog reports: Fixed an XSS vulnerability in Security Library method xssclean. Fixed a possible file inclusion vulnerability in Loader Library method vars. Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used thanks to Pa...