Samsung SW Update Tool Security Bypass Vulnerability

Samsung SW Update Tool is a set of system update tools from Samsung South Korea. A security bypass vulnerability exists in Samsung SW Update Tool version 2.2.5.16. An attacker can exploit this vulnerability to bypass security restrictions and perform unauthorized operations...

JVN#01956993: Vtiger CRM does not properly restrict access to application data

Vtiger CRM is a customer relationship management CRM software. Vtiger CRM contains a vulnerability where it does not properly restrict access to user information data. Impact A user with user privileges may create new users or alter existing user information. Solution Update the software Update t...

Edit permission check not enforced on WebDAV COPY action - ownCloud

The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files. Affected Software ownCloud Server 9.0.4 CVE-2016-????...

Cisco IOS XR Software Command Injection Vulnerability

A vulnerability in the command-line utility of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with elevated privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this...

Cisco ASR 5000 Series SNMP Community String Disclosure Vulnerability

A vulnerability in SNMP configuration management in the Cisco ASR 5000 Series could allow an unauthenticated, remote attacker to read and modify the device configuration using an SNMP read-write community string. The vulnerability occurs because the configured SNMP community string is not...

Security Advisory - Input Validation Vulnerability in Multiple Huawei Products

There is an input validation vulnerability in Huawei multiple products, an attacker with control plane access may exploit this vulnerability by crafting a malformed packet. An exploit could allow the attacker to cause a Denial of Service or execute arbitrary code. Vulnerability ID:...

Security Advisory - Input Validation Vulnerability in WiFi Driver of Huawei Smart Phone

There is an input validation vulnerability in the WiFi driver of some Huawei products. An attacker may trick a user into installing a malicious application, and the application can send given parameter to WiFi driver to crash the system or escalate user privilege. Vulnerability ID:...

Microsoft Edge and Internet Explorer XSS Filter CVE-2016-3273 Information Disclosure Vulnerability

Description Microsoft Edge and Internet Explorer are prone to an information-disclosure vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. An attacker can exploit this issue to execute...

Microsoft Edge CVE-2016-3271 Scripting Engine Information Disclosure Vulnerability

Description Microsoft Edge is prone to an information disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks...

Cisco Adaptive Security Appliance Access Control List ICMP Echo Request Code Filtering Vulnerability

A vulnerability in the Cisco Adaptive Security Appliance ASA Software implementation of access control list ACL permit and deny filters for ICMP echo reply messages could allow an unauthenticated, remote attacker to bypass ACL configurations for an affected device. ICMP traffic that should be...

MGASA-2016-0246 Updated libreoffice packages fix security vulnerability

Updated libreoffice packages fix security vulnerability: Parsing the Rich Text Format character style index was insufficiently checked for validity. Documents can be constructed which dereference an iterator to the first entry of an empty STL container CVE-2016-4324...

Cisco Prime Infrastructure Administrative Web Interface HTML Injection Vulnerability (cisco-sa-20160706-pi)

A vulnerability in the administrative web interface of Cisco Prime Infrastructure PI could allow an authenticated, remote attacker to execute arbitrary commands on the affected system and on the devices managed by the system. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might ...

Cisco Video Communication Server and Expressway Trusted Certificate Authentication Bypass Vulnerability

A vulnerability in certificate management and validation for the Mobile and Remote Access MRA feature for Cisco Expressway Series and TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to bypass authentication and access internal HTTP system resources. The...

Security Advisory - Multiple Vulnerabilities in OpenSSL in May 2016

On May 3, 2016, the OpenSSL Software Foundation released a security advisory that included six vulnerabilities. Of the six vulnerabilities disclosed, four of them may cause memory corruption or excessive memory usage, one could allow a padding oracle attack to decrypt traffic when the connection...

MGASA-2016-0241 Updated gimp packages fix security vulnerability

It was discovered that there was a use-after-free vulnerability in the channel and layer properties parsing process in GIMP CVE-2016-4994...

MGASA-2016-0234 Updated libtorrent-rasterbar packages fix security vulnerability

A specially crafted HTTP response from a tracker or potentially a UPnP broadcast can crash libtorrent-rasterbar in the parsechunkheader function. Although this function is not present in this version, upstream's additional sanity checks were added to abort the program if necessary instead of...

Siemens Patches Password Reconstruction Vulnerability in SICAM PAS

The Industrial Control Systems Cyber Emergency Response Team ICS-CERT cautioned users who work in electrical substations to update certain builds of energy automation software this week. ICS-CERT claims two vulnerabilities exist in the Siemens SICAM Power Automation System, or PAS, that could...

PHP 'unserialize()' Denial of Service Vulnerability

Description PHP is prone to a denial-of-service vulnerability. Successful exploits may allow the attacker to cause denial-of-service condition. Technologies Affected PHP PHP 5.6.29 PHP PHP 7.0 PHP PHP 7.0.0 PHP PHP 7.0.0beta3 PHP PHP 7.0.1 PHP PHP 7.0.10 PHP PHP 7.0.11 PHP PHP 7.0.12 PHP PHP 7.0....

Huawei HiSuite For Windows 4.0.3.301 Privilege Escalation

Vendor: Huawei, www.huawei.com Affected Product: HiSuite for Windows Affected Version: = 4.0.3.301 CVE ID: CVE-2016-5821 OVE ID: OVE-20160624-0001 Severity: High Author: Benjamin Gnahm @mitp0sh, Blue Frost Security GmbH Title: Huawei HiSuite Insecure Service Directory ACLs A privilege escalation...

Cisco Prime Collaboration Provisioning Lightweight Directory Access Protocol Authentication Bypass Vulnerability

A vulnerability in the Lightweight Directory Access Protocol LDAP authentication for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. The vulnerability is due to...