CVE-2017-14403

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the term parameter to module/admingroup/search.php...

CVE-2017-14403: Improper Neutralization of Special Elements used in an SQL Command

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the term parameter to module/admingroup/search.php...

PT-2017-13446

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb version 5.1-0 Description The issue concerns SQL injection via the term parameter to the "module/admin group/search.php" API endpoint. Recommendations For EyesOfNetwork web interface aka eonweb version...

CVE-2017-14140

The movepages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR...

The vulnerability of the LTE component of the Android operating system from the CAF repository, which allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the LTE component of the Android operating system exists due to insufficient verification of data related to the size of the frequency list. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the...

FAQ: Citrix Virtual Apps and Desktops Long Term Service Release (LTSR)

Table of Contents General LTSR Information LTSR upgrades Mixing LTSR, CR, and Cloud releases Support lifecycles LTSR compliance Citrix Workspace app LTSR Release timing Other considerations and resources General LTSR Information What’s new and what’s changed with the Citrix Virtual Apps and...

Legal Robot: Privilege Escalation to Admin-level Account

A security researcher discovered a potentially serious privilege escalation issue in our system which was ultimately traced to our use of the allow-deny package provided in the open source Meteor framework. We implemented a short-term fix using triggers - not great performance on the same day thi...

Windows 10 & 11 Compatibility with Citrix Virtual Desktops (XenDesktop)

With the release of the Windows 10 & 11 Operating Systems, Microsoft introduced a new way to build, deploy, and service Windows:Windows as a service. New features are packaged into Feature Updates. Bug fixes and security fixes are packaged into Quality/Feature Updates. These updates can be deploy...

What to Consider When Choosing a Security Vendor

Picking a security vendor for your managed service business should be about business model alignment, not product cost. If you’re a seasoned managed service provider MSP, you are already very familiar with the benefits of the pay-as-you-go business model. In fact, it’s most likely how you sell yo...

regioactive.de XSS vulnerability

Vulnerable URL: https://www.regioactive.de/suchen?term=%22%2F%3E%27%3E%22%3Eu%3Ci%3E5%3Csvg%2Fonload%3Dalert%28%2Fopenbugbounty%2F%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

DEBIAN-CVE-2017-9526

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key from side-channel observation during the signing process can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point...

UBUNTU-CVE-2017-9526

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key from side-channel observation during the signing process can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point...

CVE-2017-2193

Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2193

Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2193

Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2193

CVE-2017-2193 affects the Tera Term installer (versions 4.94 and earlier). The root cause is an untrusted DLL search path in the installer, enabling a Trojan horse DLL in an unspecified directory to be loaded, which could allow arbitrary code execution with the privileges of the user invoking the...

CVE-2017-2193: Untrusted Search Path

Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Tera Term Installer Untrustworthy Search Path Vulnerability

Tera Term is a terminal emulator that supports serial ports, telnet and SSH connections.Installer is the installer of it. An untrustworthy search path vulnerability exists in the installer in Tera Term 4.94 and earlier versions. An attacker can exploit this vulnerability to gain privileges with t...

Installer of Tera Term may insecurely load Dynamic Link Libraries

Overview The installer of Tera Term provided by TeraTerm Project contains an issue with the DLL search path, which may lead to insecurely load Dynamic Link Libraries CWE-427. Eili Masami of Tachibana Lab. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Informati...

JVN#06770361: Installer of Tera Term may insecurely load Dynamic Link Libraries

The installer of Tera Term provided by TeraTerm Project contains an issue with the DLL search path, which may lead to insecurely load Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the latest installer Use...