PT-2017-17020

Name of the Vulnerable Software and Affected Versions libgd2 versions prior to 2.2.5 Description The issue is related to a double free vulnerability in the gdImagePngPtr function. This vulnerability can be exploited by remote attackers to cause a denial of service, specifically through vectors...

libgcrypt -- side-channel attack vulnerability

GnuPG reports: Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You"...

CVE-2017-3751: Unquoted Search Path or Element

An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0. This could allow an attacker with local privileges to execute code with administrative privileges...

PT-2017-16084

Name of the Vulnerable Software and Affected Versions ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0 Description An unquoted service path issue was identified in the driver, which could allow an attacker with local privileges to execute code with administrative...

Ming 'parseSWF_SHAPEWITHSTYLE' function memory leak vulnerability

Ming is a Flash SWF output library written in C for use in systems developed in PHP, Perl, and so on. A memory leak vulnerability exists in the 'parseSWFSHAPEWITHSTYLE' function in the util/parser.c file in Ming version 0.4.8. An attacker can exploit this vulnerability to cause a denial of servic...

UBUNTU-CVE-2017-11705

A memory leak was found in the function parseSWFSHAPEWITHSTYLE in util/parser.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file...

PT-2017-4279

Name of the Vulnerable Software and Affected Versions: GNU Binutils versions 2.29 and earlier Description: The issue is related to the bfd make section with flags function in the section.c component of the GNU Binutils library. It allows remote attackers to cause a NULL dereference via a crafted...

DEBIAN-CVE-2015-5300

The panicgate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds...

CVE-2017-5529: Exposure of Sensitive Information to an Unauthorized Actor

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition versions 6.4.0 and below, TIBCO JasperReports...

asc-connections.com XSS vulnerability

Vulnerable URL: https://asc-connections.com/register-with-save-search?keywords="'--!confirmOPENBUGBOUNTY//...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2017-629)

This update for java-170-openjdk fixes the following issues : - Update to 2.6.10 - OpenJDK 7u141 bsc1034849 - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-351...

Beers with Talos Podcast Now Available

The first episodes of Beers with Talos are now available on iTunes and directly on talosintelligence.com/podcasts.When Talos decided to make a threat intelligence podcast, we wanted to make it different than your typical buttoned down, subdued security podcast. The BWT crew: Craig, Joel, a...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none...

FTC Promotes Privacy Awareness Week

The Federal Trade Commission FTC has released an announcement on Privacy Awareness Week, celebrated this week in the U.S. The theme of this year’s initiative is “Share with Care,” and the FTC is offering privacy tips, including how to safeguard your information online, improve your computer...

Stack overflow

PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2match.c, related to a "pattern with very many captures."...

PT-2017-17583

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 7.0.0 through 7.0.13 Palo Alto Networks PAN-OS versions 7.1.0 through 7.1.8 Description A issue exists in the Management Web Interface that could allow an attacker to tamper with export files. The Management...

ALPINE-CVE-2016-10229

udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSGPEEK flag...

CVE-2015-8671: Undefined Security Weakness

Huawei LogCenter V100R001C10 could allow an authenticated attacker to tamper with requests using a tool and submit a request to the server for privilege escalation, affecting some system functions...

CVE-2017-2352

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Unlock with iPhone" component, which allows attackers to bypass the wrist-presence protection mechanism and unlock a Watch device via unspecified vectors...