CVE-2017-8185

ME906s-158 earlier than ME906SInstaller13.1805.10.3 versions has a privilege elevation vulnerability. An attacker could exploit this vulnerability to modify the configuration information containing malicious files and trick users into executing the files, resulting in the execution of arbitrary...

CVE-2017-2699

The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into...

Privilege escalation

ME906s-158 earlier than ME906SInstaller13.1805.10.3 versions has a privilege elevation vulnerability. An attacker could exploit this vulnerability to modify the configuration information containing malicious files and trick users into executing the files, resulting in the execution of arbitrary...

CVE-2017-2693

ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B214 and earlier versions,ALE-L21C464B150 and earlier versions,ALE-L21C636B200 and earlier versions,ALE-L23C605B190 and earlier...

CVE-2017-8185

ME906s-158 earlier than ME906SInstaller13.1805.10.3 versions has a privilege elevation vulnerability. An attacker could exploit this vulnerability to modify the configuration information containing malicious files and trick users into executing the files, resulting in the execution of arbitrary...

CVE-2017-2699

CVE-2017-2699 affects the Huawei Themes app. A privilege-elevation vulnerability arises from lack of validation of uploaded theme packs, allowing an attacker to deliver malicious theme files that, when installed, could execute arbitrary code with elevated privileges. Affected are Huawei devices w...

Filepath Modification

October CMS is vulnerable to filepath modifications. The library does not validate the path of a file when it is uploaded, allowing a malicious user to create malicious files and file directories on the server...

Design/Logic Flaw

October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server...

CVE-2017-1000197

October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server...

CVE-2017-1000197

October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server...

October CMS File Path Modification Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. A file path modification vulnerability exists in the asset movement feature of October CMS build 412. An attacker can exploit this vulnerability to create malicious files on the server...

Multiple Local Memory Corruption Vulnerabilities in LibTIFF

LibTIFF is a library for reading and writing labeled image file formats. LibTIFF has multiple local memory corruption vulnerabilities that could be exploited by remote attackers to construct malicious files that could be parsed by the user, which could crash the application or execute arbitrary...

Cross site request forgery (csrf)

Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery CSRF attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into...

OsTicket File Upload Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. A security vulnerability exists in Enhancesoft osTicket version 1.10.1, which stems from the program failing to properly validate the contents of an...

CVE-2017-8025

RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server...

CVE-2017-8025

RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files. Remediation There is no fixed version for...

Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a...

Microsoft PowerPoint CVE-2017-8743 Remote Code Execution Vulnerability

Description Microsoft PowerPoint is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected...

CVE-2017-12699

An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or modify original application files with malicious ones...