200 matches found
CVE-2018-3891
An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability...
CVE-2018-13140
Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation packages...
Remote code execution
Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation packages...
CVE-2018-13140
Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation packages...
The vulnerability of the update mechanism for microprogramming software on Supermicro BMC controllers allows a hacker to execute arbitrary code.
The vulnerability of Supermicro microcontroller microprogramming software arises from insufficient verification of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by replacing the uploaded update...
Adobe Issues Patch for Actively Exploited Flash Player Zero-Day Exploit
If you have already uninstalled Flash player, well done! But if you haven't, here's another great reason for ditching it. Adobe has released a security patch update for a critical vulnerability in its Flash Player software that is actively being exploited in the wild by hackers in targeted attack...
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSyste...
SUSE-SU-2018:0552-1 Security update for SUSE Manager Server 3.1
This update fixes the following issues: nutch: - Fix hadoop log dir. bsc1061574 osad, rhnlib: - Fix update mechanism when updating the updateservice bsc1073619 pxe-default-image: - Spectre and Meltdown mitigation. CVE-2017-5753, CVE-2017-5715, CVE-2017-5754, bsc1068032 spacecmd: - Support multipl...
SUSE-SU-2018:0552-2 Security update for SUSE Manager Server 3.1
This update fixes the following issues: nutch: - Fix hadoop log dir. bsc1061574 osad, rhnlib: - Fix update mechanism when updating the updateservice bsc1073619 pxe-default-image: - Spectre and Meltdown mitigation. CVE-2017-5753, CVE-2017-5715, CVE-2017-5754, bsc1068032 spacecmd: - Support multipl...
Trend Micro Email Encryption Gateway Security Bypass Vulnerability
Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A security bypass vulnerability exists in Trend Micro Email Encryption Gateway 5...
Microsoft Skype DLL Hijacking
Hi @ll, since about two or three years now, Microsoft offers Skype as optional update on Windows/Microsoft Update. JFTR: for Microsoft's euphemistic use of "update" see Once installed, Skype uses its own proprietary update mechanism instead of Windows/Microsoft Update: Skype periodically runs...
Hashicorp vagrant-vmware-fusion 5.0.0 - Local root Privilege Escalation Exploit
Exploit for macOS platform in category local exploits After three CVEs and multiple exploits disclosed to Hashicorp they have finally upped their game with this plugin. Now the previously vulnerable non-root-owned ruby code that get executed as root by the sudo helper is no more and the sudo help...
Hashicorp vagrant-vmware-fusion 5.0.0 Local Privilege Escalation
After three CVEs and multiple exploits disclosed to Hashicorp they have finally upped their game with this plugin. Now the previously vulnerable non-root-owned ruby code that get executed as root by the sudo helper is no more and the sudo helper itself is one static Go binary with...
Hashicorp vagrant-vmware-fusion 5.0.0 - Local Privilege Escalation
After three CVEs and multiple exploits disclosed to Hashicorp they have finally upped their game with this plugin. Now the previously vulnerable non-root-owned ruby code that get executed as root by the sudo helper is no more and the sudo helper itself is one static Go binary with...
Hashicorp vagrant-vmware-fusion 5.0.0 - Local Privilege Escalation
Hashicorp vagrant-vmware-fusion 5.0.0 - Local Privilege Escalation After three CVEs and multiple exploits disclosed to Hashicorp they have finally upped their game with this plugin. Now the previously vulnerable non-root-owned ruby code that get executed as root by the sudo helper is no more and...
Unauthorized Access Vulnerability in Multiple Cisco Products
Cisco Voice Operating System is a set of voice operating system of the United States Cisco Cisco.Cisco Unified Communications Manager UCM and so on are based on the Cisco Voice Operating System platform products.Cisco Unified Communications Manager UCM is a call processing component of the unifie...
Threatpost News Wrap, August 18, 2017
Mike Mimoso and Tom Spring discuss this week’s security news, including recent abuse of Google Chrome extensions for fraud, a close look at Adobe’s decision to end of life Flash Player, and a backdoor discovered in NetSarang server management software’s update mechanism. Download: Threatpost News...
Attackers Backdoor NetSarang Software Update Mechanism
Attackers infiltrated the update mechanism for a popular server management software package as recently as last month and modified it to include a backdoor. NetSarang, which has headquarters in South Korea and the United States, has removed the backdoored update, but not before it was activated o...
[SECURITY] [DSA 3716-1] firefox-esr security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3716-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 16, 2016 https://www.debian.org/security/faq -...