CVE-2016-3262

Graphics Device Interface aka GDI or GDI+ in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync...

ZOHO ManageEngine ServiceDesk Plus Privilege Vulnerability

ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. An elevation of privilege vulnerability exists in ManageEngine ServiceDesk Plus 9.0 and prior versions, which can be exploited by an attacker to gain...

ManageEngine ServiceDesk Plus Multiple Vulnerabilities

ManageEngine ServiceDesk Plus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ZOHO ManageEngine ServiceDesk Plus Security Bypass Vulnerability

ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. A security bypass vulnerability exists in ManageEngine ServiceDesk Plus 9.2 and prior versions, which can be exploited by an attacker to bypass security...

ZOHO ManageEngine ServiceDesk Plus HTML Injection Vulnerability

ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. An HTML injection vulnerability exists in ManageEngine ServiceDesk Plus 9.2 and prior versions, which stems from the program's inability to adequately filte...

ManageEngine ServiceDesk Plus uses an insecure method for cookie generation

Overview ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus uses an insecure method for generating cookies. Akihito Mukai and Tomoshige Hasegawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

ManageEngine ServiceDesk Plus fails to restrict access permissions

Overview ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus fails to restrict access permissions. Akihito Mukai and Tomoshige Hasegawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

ManageEngine ServiceDesk Plus vulnerable to cross-site scripting

Overview ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus contains a stored cross-site scripting CWE-79 vulnerability. Akihito Mukai and Tomoshige Hasegawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

JVN#72559412: ManageEngine ServiceDesk Plus uses an insecure method for cookie generation

ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus uses an insecure method for generating cookies. Impact If an attacker obtains a user's cookie, the password contained in the cookie can be easily guessed. Solution Update the software...

JVN#89726415: ManageEngine ServiceDesk Plus fails to restrict access permissions

ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus fails to restrict access permissions. Impact A user logged in with guest privileges may access functions for which permissions are not granted. Solution Update the software Update to...

CVE-2016-8279

The video driver in Huawei Mate S smartphones with software CRR-TL00 before CRR-TL00C01B362, CRR-UL20 before CRR-UL20C00B362, CRR-CL00 before CRR-CL00C92B362, and CRR-CL20 before CRR-CL20C92B362; P8 smartphones with software GRA-TL00 before GRA-TL00C01B366, GRA-UL00 before GRA-UL00C00B366, GRA-UL...

CVE-2016-8279

CVE-2016-8279 affects Huawei video driver in Mate S (CRR-TL00/UL20/CL00/CL20 before specific Cxx2 builds), P8 (GRA-TL00/UL00/UL10/CL00 before specific Cxx2 builds), and Honor 6/6 Plus (before 6.9.16). A crafted application can cause a denial of service by rebooting the device. Affected software v...

Crypto++ Information Disclosure Vulnerability

Crypto++ aka cryptopp is a free C++ library. A security vulnerability exists in Crypto++ 5.6.4 and earlier versions, which can be exploited by an attacker to obtain sensitive information by accessing process memory...

Bitdefender Antivirus Plus avc3 Kernel Driver Elevation of Privilege Vulnerability

Bitdefender Antivirus Plus is an antivirus plugin. Bitdefender Antivirus Plus suffers from a security vulnerability in the avc3 kernel driver handling IOCTL 0x002222f4. An attacker could exploit this vulnerability to execute arbitrary code on the target system...

Bitdefender Antivirus Plus bdfwfpf Elevation of Privilege Vulnerability

Bitdefender Antivirus Plus is an antivirus plugin. Bitdefender Antivirus Plus has a security vulnerability in bdfwfpf processing 0x8000e038 IOCTL. An attacker could exploit this vulnerability to elevate its privileges on the target system...

Cisco Small Business 220 Series Smart Plus Switches Denial of Service Vulnerability

Cisco Small Business 220 Series Smart Plus Switches is a 220 Series stackable managed switch product from Cisco USA. A denial of service vulnerability exists in Cisco Small Business 220 Series Smart Plus Switches. An attacker could exploit this vulnerability to cause a denial of service...

Cisco Small Business 220 Series Smart Plus Switches Unauthorized Access Vulnerability

Cisco Small Business 220 Series Smart Plus Switches is a 220 Series stackable managed switch product from Cisco USA. An unauthorized access vulnerability exists in Cisco Small Business 220 Series Smart Plus Switches. An attacker could exploit this vulnerability to gain unauthorized access to an...

Cisco Small Business 220 Series Smart Plus Switches Cross-Site Scripting Vulnerability

The Cisco Small Business 220 Series Smart Plus Switches are smart switches. Cisco Small Business 220 Series Smart Plus Switches cross-site scripting vulnerability that fails to properly validate user-submitted inputs allows an attacker to exploit the vulnerability to execute arbitrary code in the...

Bitdefender Antivirus Plus avc3 Kernel Driver Untrusted Pointer Dereference Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Bitdefender Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Cisco Small Business 220 Series Smart Plus Switches Web Interface Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business 220 Series Smart Plus Sx220 Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to...