CVE-2017-0064

A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka "Internet Explorer Security Feature Bypass Vulnerability."...

.NET Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft .NET Framework and .NET Core components do not completely validate certificates. An attacker could present a certificate that is marked invalid for a specific use, but the component uses it for that purpose. This action disregards the...

Internet Explorer Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings. This could allow for the loading of unsecure content HTTP from secure locations HTTPS. In a web-based attack scenario, an attacker could host a malicious website that is designed ...

Microsoft Internet Explorer Security Feature Bypass (CVE-2017-0064)

A security feature bypass vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to improper implementation of the mixed content warning security feature. A remote attacker can exploit this issue by enticing a user to open a specially crafted web-page with an affected versi...

Avast Pro Antivirus Multiple Vulnerabilities

Avast Pro Antivirus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:avast:avastproantivirus...

Security feature bypass

The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks...

Security feature bypass

The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of size 1 during processing of a corrupt binary containing relocs with negative addresses. This vulnerability causes programs that conduct an...

CVE-2017-0159

A security feature bypass vulnerability exists in Windows 10 1607, Windows Server 2012 R2, and Windows 2016 when ADFS incorrectly treats requests coming from Extranet clients as Intranet requests, aka "ADFS Security Feature Bypass Vulnerability."...

Security feature bypass

Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to bypass the Office Protected View via a specially crafted document, aka "Microsoft Office Security Feature Bypass Vulnerability."...

CVE-2017-0159

A security feature bypass vulnerability exists in Windows 10 1607, Windows Server 2012 R2, and Windows 2016 when ADFS incorrectly treats requests coming from Extranet clients as Intranet requests, aka "ADFS Security Feature Bypass Vulnerability."...

CVE-2017-0159

CVE-2017-0159 affects Windows 10 (1607), Windows Server 2012 R2, and Windows Server 2016. Root cause: ADFS may treat Extranet requests as Intranet, bypassing account lockout protections and enabling easier brute-force access. Public exploit details are not provided in the connected documents. Rem...

Windows 8.1 and Windows Server 2012 R2 April 2017 Security Updates

The remote Windows host is missing security update 4015547 or cumulative update 4015550. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the open-source libjpeg image processing library due to improper handling of objects in memory. An...

Security Update for Microsoft Office Products (April 2017) (Petya)

The Microsoft Office application, Office Web Apps, or SharePoint Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - An arbitrary code execution vulnerability exists in Microsoft Outlook due to improper parsing of...

Microsoft Fixes 45 Vulnerabilities with new Security Update Guide – says goodbye to Security Bulletins

Today is the first month since 1998 in which Microsoft stopped releasing security bulletins with the familiar MSxx-xxx format and replaced it with the new security update guide. We talked about this change earlier in a few blog posts and finally today it’s time to say good bye to security bulleti...

ADFS Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when ADFS incorrectly treats requests coming from Extranet clients as Intranet requests. To exploit this vulnerability, an attacker could run a specially crafted application and attempt to brute-force an account password. An attacker who successfully...

KLA11059 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, bypass security restrictions, cause denial of service. Below is a complete list of vulnerabilities: 1. A remote cod...

Security feature bypass

Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without invalidating associated signatures, aka "PowerShell Security Feature Bypass Vulnerability."...

CVE-2017-0135

CVE-2017-0135 describes a security feature bypass in Microsoft Edge enabling a SOP bypass for HTML elements across browser windows. The core official description notes it is distinct from CVE-2017-0066/0140. A connected article discusses bypassing Edge’s XSS filter/CSP handling, but the provided ...

CVE-2017-0066

Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability." This vulnerability is different from those described in CVE-2017-0135 and CVE-2017-0140...

Security feature bypass

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...