CVE-2018-0353

A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor L4TM functionality and bypass security protections. The vulnerability is due to a change in the underlying operating system...

Cross site request forgery (csrf)

QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections...

CVE-2017-7635

QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections...

CVE-2017-7635

QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections...

Vgate iCar2 WiFi OBD2 Dongle Inadequate Access Protections

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unprotected WiFi access & Unencrypted data transfer product: Vgate iCar 2 WiFi OBD2 Dongle vulnerable version: Vgate iCar 2 WiFi OBD2 Dongle fixed version: - CVE number:...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 34 security fixes in this release, including: 835639 High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22 840320 High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07 818592 High...

SimpliSafe Original Security Bypass Vulnerability

SimpliSafe Original is a home security management system. The system includes video surveillance and intrusion alarms, among other things. A security vulnerability exists in SimpliSafe Original. An attacker in close physical proximity could exploit the vulnerability to bypass security protections...

CVE-2018-9091

A critical vulnerability in the KEMP LoadMaster Operating System LMOS 6.0.44 through 7.2.41.2 and Long Term Support LTS LMOS before 7.1.35.5 related to Session Management could allow an unauthenticated, remote attacker to bypass security protections, gain system privileges, and execute elevated...

CVE-2018-6664

CVE-2018-6664 affects McAfee Data Loss Prevention (DLP) Endpoint: the DLP Agent prior to 10.0.500 or 11.x prior to 11.0.400 allows an authenticated user to bypass the product block via a command-line utility. Impact is a master bypass of protection, with no details on exploitation in the wild pro...

CVE-2018-6664 SB10233 - Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 - Application Protections Bypass vulnerability

Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention DLP Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility...

BaserCMS Restricted Access Vulnerability

baserCMS is an enterprise-level content management system CMS. A restricted access vulnerability exists in baserCMS versions 4.1.0.1 and earlier and 3.0.15 and earlier, which stems from the program failing to restrict access. A remote attacker can use this vulnerability to bypass access...

KLA11030 Speculative Store Bypass and Rogue System Register Read vulnerabilities in Microsoft Surface Products

On January 3, 2018, Microsoft released advisories and security updates related to a recently discovered class of hardware vulnerabilities known as Spectre and Meltdown that affect AMD, ARM, and Intel CPUs. On May 21, 2018, Intel announced the Rogue System Registry Read vulnerability. Also a new...

Simple bug could lead to RCE flaw on apps built with Electron Framework

A critical remote code execution vulnerability has been discovered in the popular Electron web application framework that could allow attackers to execute malicious code on victims' computers. Electron is an open source app development framework that powers thousands of widely-used desktop...

CVE-2018-10962

An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe allow local users to bypass intended process protections, and consequently terminate processes, because mouseevent is not properly considered...

CVE-2018-10962

An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe allow local users to bypass intended process protections, and consequently terminate processes, because mouseevent is not properly considered...

Design/Logic Flaw

An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe allow local users to bypass intended process protections, and consequently terminate processes, because mouseevent is not properly considered...

CVE-2018-10962

The CVE-2018-10962 entry describes a local-bprivilege issue in Shanghai 2345 Security Guard 3.7.0 where 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe fail to properly consider mouse_event, allowing a local user to bypass process protections and terminate processes. Affected components ar...

CVE-2018-5157

Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR 52.8 an...

Security vulnerabilities fixed in Firefox 60 — Mozilla

A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially...

May 2018 security update release

Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide. MSRC team...