1738 matches found
Samsung Patches Six Critical Bugs in Flagship Handsets
Samsung began rolling out patches over the weekend to fix six critical bugs found in its flagship Android handsets as part of its May patch bulletin. Flaws range from a remote code execution bug to a buffer overflow vulnerability, plus a peek-and-poke command bug that leaves memory locations open...
Citrix XenServer Multiple Security Updates
Description of Problem A number of security vulnerabilities have been identified in Citrix XenServer that may allow malicious code running in a PV guest VM to compromise the host and malicious privileged code running in an HVM guest VM to crash the host. These vulnerabilities affect all currently...
New Relic: User is able to access and create private synthetics locations without upgrading (regression of #276157)
It seems like the fix done for 276157 wasn't enough, as I'm able to bypass it and generate private synthetics locations without approval or the proper plan. This is the page that users see when they navigate to the private synthetics location: F291890 I'm able bypass this by navigating as an Admi...
Penetration Testers Framework: PTF
The PenTesters Framework PTF is a Python script designed for Debian/Ubuntu/ArchLinux based distributions to create a similar and familiar distribution for Penetration Testing. As pentesters, we’ve been accustom to the /pentest/ directories or our own toolsets that we want to keep up-to-date all o...
sup2thepeople.com XSS vulnerability
Open Bug Bounty ID: OBB-607568 Description| Value ---|--- Affected Website:| sup2thepeople.com Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
unitedoilco.com XSS vulnerability
Open Bug Bounty ID: OBB-606380 Description| Value ---|--- Affected Website:| unitedoilco.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Code injection
Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary memory locations. This can result in arbitrary code execution, compromised data integrity, denial of service, and system crash...
CVE-2017-9634
Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary memory locations. This can result in arbitrary code execution, compromised data integrity, denial of service, and system crash...
Microsoft Office: Allow mix of policy and user locations
This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013mixpolicyanduserlocations.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Allow mix of policy and user locations Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...
CVE-2017-0359
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive...
Design/Logic Flaw
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive...
UBUNTU-CVE-2017-0359
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive...
PYSEC-2018-83
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive...
CVE-2017-0359 diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive...
CVE-2017-0359
Diffoscope is vulnerable to arbitrary file overwrite: versions before 77-1 may write to arbitrary locations on disk based on untrusted archive contents. Upstream fix shipped in 77; advisories (Arch Linux ASA-201702-14, Fedora updates, Debian/CVE records) note upgrade to 77-1 or newer to mitigate....
RubyGems Directory Traversal Vulnerability
RubyGems is a package manager for Ruby that provides a standard format for distributing Ruby programs and libraries called "gems", and is designed to make it easy to manage gem-installed tools, as well as servers for distributing gems. A directory traversal vulnerability exists in the RubyGems ge...
Tech support scammers GeeksHelp caught again, two years later
Many researchers have noted an increase in tech support scam activity during the past few months. This trend, facilitated by browser lockers, is not surprising considering that other web-based infection methods are not as effective. While people are still receiving cold calls from alleged Microso...
USN-3579-3: LibreOffice regression
USN-3579-1 fixed a vulnerability in LibreOffice. After upgrading, it was no longer possible for LibreOffice to open documents from certain locations outside of the user's home directory. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovere...
foreman: privilege escalation through Organization and Locations API
It was found that Satellite 6 did not properly enforce access controls on certain resources. An attacker, with access to the API and knowledge of the ID name, can potentially access other resources in other organizations...
foreman: Information leak through organizations and locations feature
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned no organizations/locations, they are able to view all resources instead of none mirroring an administrator's view. The user's actions are still limited by their...