12585 matches found
Microsoft Edge CVE-2017-8530 Security Bypass Vulnerability
Description Microsoft Edge is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Technologies Affected Microsoft Edge Recommendations Block external acces...
Microsoft Windows Search CVE-2017-8543 Remote Code Execution Vulnerability
Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to execute arbitrary code on the target system. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit...
MGASA-2017-0167 Updated lxc packages fix security vulnerabilities
Roman Fiedler discovered a directory traversal flaw in lxc-attach. An attacker with access to an LXC container could exploit this flaw to access files outside of the container CVE-2016-8649. Jann Horn discovered that LXC incorrectly verified permissions when creating virtual network interfaces. A...
Cybozu KUNAI for Android vulnerable to cross-site scripting
Overview Cybozu KUNAI for Android is mobile client software for using Cybozu from an Android device. Cybozu KUNAI for Android contains a cross-site scripting vulnerability CWE-79 due to an issue in mobile view mode. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its...
HPESBUX03747 rev.1 - HP-UX running BIND, Remote Denial of Service
Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX DNS and BIND Software B.11.31 - BIND 9.9.4 prior to C.9.9.4.10.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2017-3135 |...
Cisco Prime Data Center Network Manager Debug Remote Code Execution Vulnerability
A vulnerability in the role-based access control RBAC functionality of Cisco Prime Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system. The vulnerability is due to the...
Security Advisory - SQL Injection Vulnerability in the GaussDB
The GaussDB has a SQL injection vulnerability. An attacker with low privilege may inject some specific SQL to query or modify database files, causing database service abnormal. Vulnerability ID: HWPSIRT-2017-05017 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...
JVN#20870477: Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to remote code execution
AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains a remote code execution vulnerability. Impact When accessing a specially crafted URL, arbitrary code may be...
Security Advisory - Memory Double Free Vulnerability in Driver of Some Huawei Smart Phones
The soundtrigger driver of some Huawei smart phones has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash...
DLA-976-1 yodl - security update
Bulletin has no description...
HikaShop Business,3.1.0,SQL Injection
HikaShop Business,3.1.0,SQL Injection new version number 3.1.1 Update Notice URL https://www.hikashop.com/home/blog/373-security-release-for-hikashop-business.html...
DLA-972-1 openldap - security update
Bulletin has no description...
DLA-971-1 nss - security update
Bulletin has no description...
Security Advisory - Two Privilege Escalation Vulnerabilities in the GaussDB
There is a privilege escalation vulnerability in the validator functions of the GaussDB. An attacker may log in to the system as a low-privilege user and execute the high-privilege functions. Then, the attacker may obtain the high-privilege of the GaussDB and crash the system. Vulnerability ID:...
Security Advisory - Command Injection Vulnerability in the NetEco
Huawei iManager NetEco has a command injection vulnerability due to insufficient input validation. An authenticated, remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploit could enable a low privileged user to execute commands that a high...
DSA-3866-1 strongswan - security update
Bulletin has no description...
Security Advisory - Multiple Vulnerabilities in MTK Platform
There are multiple vulnerabilities in the graphics driver of MTK platform in Huawei smart phones. The graphics driver has two buffer overflow vulnerabilities due to the insufficient input verification. An attacker tricks a user into installing a malicious application which has the system privileg...
MGASA-2017-0146 Updated perl-CGI-Emulate-PSGI packages fix security vulnerability
This update removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387...
JVN#42164352: GroupSession fails to restrict access permissions
GroupSession provided by Japan Total System Co.,Ltd. is open source groupware. GroupSession fails to restrict access permissions. Impact An authenticated attacker may obtain other user's senisitive information such as email. Solution Update the Software Update to the latest version according to t...