AcoraCMS 7.0.0.6 Browser Redirect / Cross Site Scripting

https://www.osisecurity.com.au/acoracms-browser-redirect-and-cross-site-scripting-vulnerabilities.html Date: 04-Apr-2017 Product: AcoraCMS Versions affected: 7.0.0.6 known bugs from 6.0.6 are still present http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt. Vulnerabilities: 1 Arbitrar...

Airwatch 6.1.x / 6.4.x LDAP Injection

https://www.osisecurity.com.au/airwatch-self-service-portal-username-parameter-ldap-injection.html Date: 04-Apr-2017 Product: AirWatch Self Service MDM Versions affected: v6.1.x v6.4.x Vulnerability: LDAP injection Example: https://target/DeviceManagement/ URL accepts the following POST parameter...

Kaseya VSA 6.5.0.0 XSS / Brute Force

https://www.osisecurity.com.au/kaseya-parameter-reflected-xss-enumeration-and-bruteforce-weakness.html Date: 04-Apr-2017 Software: Kaseya Affected version: Kaseya VSA v6.5.0.0. Vulnerability details: 1. The "forgot password" function at https://target/access/logon.asp reveals whether a username i...

SmartJobBoard 5.0.9 Cross Site Scripting / Information Disclosure

https://www.osisecurity.com.au/smartjobboard---cross-site-scripting-personal-information-disclosure-and-phpmailer-package.html Date: 04-Apr-2017 Product: SmartJobBoard Versions affected: v5.0.9 and below. Vulnerability: 1 Cross-site scripting vulnerabilities in the following locations and...

KLA10971 Vulnerability in Mozilla Firefox and Mozilla Firefox ESR

Integer overflow vulnerability was found in Mozilla Firefox and Mozilla Firefox ESR. By exploiting this vulnerability malicious users possibly can obtain sensitive information and cause a denial of service. This vulnerability can be exploited remotely via experimental extensions. NB: This...

KLA10987 Information disclosure in Windows DVD Maker

An improper parsing of .msdvd files was found in Windows DVD maker. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed .msdvd file. Original advisories MS17-020 CVE-2017-0045 Exploitation Public...

KLA10986 Information disclosure vulnerability in Microsoft Active Directory Federation Services

An improper honoring of XML External Entities was found in Microsoft Active Directory Federation Services ADFS. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed request. Original advisories...

KLA10988 Information disclosure vulnerability in Windows DirectShow

An improper objects handling in memory was found in Windows DirectShow. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed website. Original advisories MS17-021 CVE-2017-0042 Exploitation Public...

KLA10973 Multiple vulnerabilities in Adobe Flash Player

Multiple serious vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to obtain sensitive information or execute arbitrary code. Below is a complete list of vulnerabilities: 1. A buffer overflow/underflow vulnerability in the Primetime TVSDK can...

KLA10970 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to obtain sensitive information, run arbitrary code and cause a denial of service. Below is a complete list of vulnerabilities 1. Memory curruption vulnerability in asm.js ca...

HackerOne Offers Open Source Projects Free Access to Platform

HackerOne announced on Thursday the availability of a free version of its bug bounty platform called HackerOne Community Edition that will give open source projects tools for managing vulnerability submissions and creating bounty programs to improve software security. Eligible open source project...

KLA10957 Multiple vulnerabilities in Oracle Java SE

Multiple serious vulnerabilities have been found in Oracle Java SE components. By exploiting these vulnerabilities malicious users can gain privileges and obtain sensitive information. These vulnerabilities can be exploited remotely by unauthenticater attacker having network access via multiple...

KLA11171 OSI vulnerability in Adobe Flash Player

Out-of-bounds read vulnerability in Adobe Flash Player can be exploited locally to obtain sensitive information. Technical details To update Adobe Flash Player ActiveX detected as Flash.ocx on Windows 8 and higher, install latest updates from Control Panel Original advisories APSB18-01 Exploitati...

KLA10945 Information leak and denial of service vulnerabilities in Kaspersky products

Multiple serious vulnerabilities have been found in Kaspersky products. Malicious users can exploit these vulnerabilities to cause denial of service or obtain sensitive information. Below is a complete list of vulnerabilities: 1. Multiple information leaks in different IOCTL handlers of Kaspersky...

KLA10952 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause a denial of service, obtain sensitive information and execute arbitrary code. Below is a complete list of vulnerabilities 1. Errors in...

KLA10923 Privilege escalation vulnerability in Microsoft Windows

Improper objects handling in memory was found in the Secure Kernel Mode implementation in Microsoft Windows. By exploiting this vulnerability malicious users can gain priveleges and violate virtual trust levels VTL. This vulnerability can be exploited locally via a specially designed application...

KLA10925 Information Disclosure vulnerability in Microsoft .NET Framework 4.6.2

Mishandling of a developer-supplied key was found in Microsoft .NET 4.6.2 Framework’s Data Provider for SQL Server. By exploiting this vulnerability malicious users can obtain sensitive cleartext information. This vulnerability can be exploited remotely via leveraging key guessability. Original...

KLA10893 Multiple vulnerabilities in Yandex browser

Multiple serious vulnerabilities have been found in Yandex Browser. Malicious users can exploit these vulnerabilities to inject arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Cross-site scripting vulnerabilities at Translator and BookReader can be...

KLA10888 Multiple vulnerabilities in Oracle VM VirtualBox

Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to cause denial of service, affect integrity or obtain sensitive information. These vulnerabilities can be executed remotely and related to Core, OpenSSL and VRDE. Original...

KLA10887 Multiple vulnerabilities in Oracle Java SE

An unspecified vulnerabilities were found in Oracle Java SE. By exploiting this vulnerability malicious users can cause denial of service, affect integrity or obtain sensitive information. This vulnerability can be exploited remotely. Technical details These vulnerabilities are related to 2D, AWT...