CVE-2017-5899: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the setuid root helper binary in S-nail later S-mailx before 14.8.16 allows local users to write to arbitrary files and consequently gain root privileges via a .. dot dot in the randstr argument...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

codeigniter -- multiple vulnerabilities

The CodeIgniter changelog reports: Fixed an XSS vulnerability in Security Library method xssclean. Fixed a possible file inclusion vulnerability in Loader Library method vars. Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used thanks to Pa...

NVIDIA GeForce Experience Information Disclosure Vulnerability

NVIDIA GeForce Experience is a suite of automatic graphics card update tools from NVIDIA. A security vulnerability exists in the NVIDIA Web Helper.exe file in NVIDIA GeForce Experience version 3.x prior to 3.1.0.52, which stems from the program failing to properly perform access control and...

CVE-2016-8827

NVIDIA GeForce Experience 3.x before GFE 3.1.0.52 contains a vulnerability in NVIDIA Web Helper.exe where a local web API endpoint, /VisualOPS/v.1.0./, lacks proper access control and parameter validation, allowing for information disclosure via a directory traversal attack...

CVE-2016-8827

CVE-2016-8827 affects NVIDIA GeForce Experience 3.x before GFE 3.1.0.52. The vulnerability is in the NVIDIA Web Helper.exe local web API endpoint /VisualOPS/v.1.0./, which lacks proper access control and parameter validation, enabling information disclosure via a directory traversal attack. Impac...

APT - Repository Signing Bypass via Memory Allocation Failure

APT - Repository Signing Bypass via Memory Allocation Failure Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1020 == Vulnerability == When apt-get updates a repository that uses an InRelease file clearsigned Release files, this file is processed as follows: First, the InRelease...

Security update for mariadb (important)

This update for mariadb to 10.0.27 fixes the following issues: release notes: https://kb.askmonty.org/en/mariadb-10027-release-notes https://kb.askmonty.org/en/mariadb-10026-release-notes changelog: https://kb.askmonty.org/en/mariadb-10027-changelog...

openSUSE Security Update : squid (openSUSE-2016-988)

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues : - Fixed multiple Denial of Service issues in HTTP Response processing. CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc968392, bsc968393, bsc968394, bsc968395 - CVE-2016-3947: Buffer...

OpenCart 'helper/json.php' Remote PHP Code Execution Vulnerability

OpenCart is an open source e-commerce system of China OpenCart company . OpenCart fails to properly validate user-submitted input, allowing remote attackers to exploit the vulnerability by submitting special requests to execute arbitrary PHP code...

Debian GNU/Linux Remote Compromise

The multiple vulnerabilities in the cups-pk-helper package of the Debian GNU/Linux operating system may lead to breaches of confidentiality and integrity of protected information. These vulnerabilities can be exploited remotely...

PT-2016-5068

Name of the Vulnerable Software and Affected Versions Magento Enterprise Edition versions prior to 1.14.2.3 Magento Community Edition versions prior to 1.9.2.3 Description The issue allows remote attackers to obtain sensitive order information. This is achieved by exploiting the...

Design/Logic Flaw

The 1 git-remote-ext and 2 unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a a .gitmodules file ...

CVE-2015-5969

The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and the mariadb package before 10.0.22-2.21.2 in openSUSE 13.2 and before 10.0.22-3.1 in SUSE Linux Enterprise SLE 12.1 and openSUSE Leap 42.1...

CVE-2015-5969: Exposure of Sensitive Information to an Unauthorized Actor

The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and the mariadb package before 10.0.22-2.21.2 in openSUSE 13.2 and before 10.0.22-3.1 in SUSE Linux Enterprise SLE 12.1 and openSUSE Leap 42.1...

KOSMOS Helper App - SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application KOSMOS Helper App published at the 'play' market has multiple vulnerabilities...

Med Helper Pill Reminder - Customized SSL, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Med Helper Pill Reminder published at the 'play' market has multiple vulnerabilities...

Market Helper - Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Market Helper published at the 'play' market has multiple vulnerabilities...

Flirt Helper - Customized SSL, External URLs, KeyStore usage vulnerabilities

HackApp vulnerability scanner discovered that application Flirt Helper published at the 'play' market has multiple vulnerabilities...

Little Helper - Dangerous filesystem permissions, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Little Helper published at the 'play' market has multiple vulnerabilities...