Windows GDI Information Disclosure Vulnerability

A Win32k information disclosure vulnerability exists when the Windows GDI component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker...

PT-2017-2332

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Office Online Server affected versions not specified PowerPoint for Mac affected versions not specified Office Web Apps Server affected versions not specified Microsoft SharePoint Server affecte...

MongoDB DoS Vulnerability (May 2017) - Linux

MongoDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb";...

Microsoft Chakra Core Remote Code Execution Vulnerability

Chakra is a JavaScript engine developed by Microsoft for its web browsers. A security vulnerability in the way the JavaScript engine is rendered when handling in-memory objects in Microsoft Chakra Core could be exploited by remote attackers to construct malicious web pages that could be parsed by...

Microsoft Edge Remote Code Execution Vulnerability

Microsoft Edge is the web browser built into the Windows 10 version. A remote code execution vulnerability exists in the scripting engine presentation when Microsoft Edge handles in-memory objects, where an attacker could execute arbitrary code in the current user context...

PT-2017-2150

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Microsoft Office Web Apps affected versions not specified Microsoft Word affected versions not specified Word Viewer affected versions not specified Microsoft SharePoint Server affected versions...

CVE-2016-3104

mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service memory consumption and process termination by leveraging in-memory database representation when authenticating against a non-existent database...

CVE-2016-3104

mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service memory consumption and process termination by leveraging in-memory database representation when authenticating against a non-existent database...

CVE-2016-3104

Removed by vendor...

CVE-2017-0202: Improper Restriction of Operations within the Bounds of a Memory Buffer

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, a.k.a. "Internet Explorer Memory Corruption...

Microsoft Windows Uniscribe Information Disclosure Vulnerability (CNVD-2017-03757)

Microsoft Uniscribe is a component of the Windows operating system developed by Microsoft Corporation for the correct presentation of Unicode characters. An information disclosure vulnerability exists in Microsoft Uniscribe's handling of in-memory objects, which allows remote attackers to exploit...

SAP Patches Critical HANA Vulnerability That Allowed Full Access

SAP patched a series of critical vulnerabilities in its cloud-based business platform HANA today that if exploited, could allow for a full system compromise without authentication. When chained together the flaws could lead to the theft of confidential information, financial fraud, and the...

Microsoft Office Memory Corruption (MS17-014: CVE-2017-0006)

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to the way Microsoft Office improperly handles objects in memory. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...

CVE-2014-8688: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db file...

VulnCheck KEV: CVE-2017-0022

Microsoft XML Core Services MSXML improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site...

Uncovering cross-process injection with Windows Defender ATP

Windows Defender Advanced Threat Protection Windows Defender ATP is a post-breach solution that alerts security operations SecOps personnel about hostile activity. As the nature of attacks evolve, Windows Defender ATP must advance so that it continues to help SecOps personnel uncover and address...

Authenticated WMI Exec Via Powershell

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/powershell' require 'msf/core/post/windows/priv' require 'msf/core/exploit/powershell/dotnet' class MetasploitModule...

PT-2016-2746

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge Description The issue allows remote attackers to obtain sensitive information via a crafted web site. This is due to the way the affected components handle objects in memory, whi...

DLA-577-1 redis - security update

Bulletin has no description...

The vulnerability of the Internet Explorer browser, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for the execution of arbitrary code remotely exists in Internet Explorer due to incorrect access to objects in memory. This vulnerability can cause errors when working with memory and allow attackers to execute arbitrary code in the context of the current user...