VulnCheck KEV: CVE-2017-3197

GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 version F6 and GB-BXi7-5775 version F2 platforms does not securely implement BIOSWE, BLE, SMMBWP, and PRx features. As a result, the BIOS is not protected from arbitrary write access and may permit modifications to the SPI flash...

Microsoft Edge browser vulnerability, allowing a hacker to execute arbitrary code

The vulnerability of the Microsoft Edge browser’s script is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

DOBBY Pocket Drone Android App Signature Has Arbitrary Password Reset Vulnerability

Zero Intelligent Control Beijing Intelligent Technology Co., Ltd. is committed to becoming the world's top supplier of intelligent aircraft products and intelligent drone total solutions.DOBBY Pocket Drone is one of the company's products. There is an arbitrary password reset vulnerability in the...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the McAfee VirusScan Enterprise antivirus software is related to deficiencies in its authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause service interruptions remotely...

Hacker Reveals Easiest Way to Hijack Privileged Windows User Session Without Password

You may be aware of the fact that a local Windows user with system rights and permissions can reset the password for other users, but did you know that a local user can also hijack other users' session, including domain admin/system user, without knowing their passwords? Alexander Korznikov, an...

bmw-boerse.at XSS vulnerability

Open Bug Bounty ID: OBB-219446 Description| Value ---|--- Affected Website:| bmw-boerse.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the Android operating system, which allows a hacker to execute an application with privileges of the current user

The vulnerability of the NVIDIA GPU operating system for Android is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to execute an application with privileges of the current user...

The vulnerability of the Android operating system, which allows a hacker to execute code within the context of a privileged process

The vulnerability of the Android operating system’s security subsystem is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute code within the context of a privileged process, using a local malware application...

The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability of the Broadcom Wi-Fi driver for the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute arbitrary code within the kernel context, using a local malicious applicatio...

The vulnerability of the Mac OS X operating system allows a hacker to trigger a service failure or increase their privileges.

The vulnerability of the ATS component in the Mac OS X operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder to enhance their privileges locally or cause service failures such as memory corruption or application termination using...

The vulnerability of the iOS operating system, which allows a perpetrator to gain access to protected information

The vulnerability of the Contacts component in the iOS operating system is related to deficiencies in access control for the Address Book application. Exploiting this vulnerability could allow a malicious actor, operating locally, to gain access to protected information...

About the security content of Apple Remote Desktop 3.9

About the security content of Apple Remote Desktop 3.9 This document describes the security content of Apple Remote Desktop 3.9. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

Slack: Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domain

@fransrosen discovered a vulnerability which would allow an attacker running a malicious site to steal XOXS tokens. We resolved the postMessage and call-popup redirect issues, and performed a thorough investigation to confirm that this had never been exploited. Thanks @fransrosen for an interesti...

CVE-2016-8353

An issue was discovered in OSIsoft PI Web API 2015 R2 Version 1.5.1. There is a weakness in this product that may allow an attacker to access the PI system without the proper permissions...

Vulnerability of the Java Platform software platform, which allows a perpetrator to gain access to data for reading purposes

The vulnerability of the Java Mission Control component of the Java Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain read access to data through network packets...

CVE-2016-5711

NetApp Virtual Storage Console for VMware vSphere before 6.2.1 uses a non-unique certificate, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors...

Weak Cryptographic Protection Mechanisms

OpenSSL has weak cryptographic protection mechanism. The way that the BNsqr function in OpenSSL is implemented is incorrect. It doesn't not calculate the square of a BIGNUM value making it easier for attackers to get past the protection mechanism...

The vulnerability of the Android operating system, which allows a perpetrator to trigger a service failure or otherwise affect the system.

The vulnerability of the Audioserver component in the Android operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to cause service failures or otherwise affect the system...

The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability of the libnl library in the Android operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of Google Chrome browser allows a perpetrator to bypass the certificate verification process.

The vulnerability of Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass certificate verification by using a specially created HTML page...