CVE-2018-12892

Concretely, CVE-2018-12892 affects Xen 4.7–4.10.x when using libxl with qemu-xen: libxl fails to pass the readonly flag to QEMU for emulated SCSI disks (disk type sd) due to an erroneous merge conflict resolution. This can allow malicious guest administrators or certain users to write to original...

CVE-2018-11259

Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and...

Microsoft Windows: Deny write access to removable drives not protected by BitLocker

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winrmdenywriteaccess.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Deny write access to removable drives not protected by BitLocker Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: Write access to devices configured in another organization

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winrmdenycrossorgwrite.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization Authors:...

kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism

The mm subsystem in the Linux kernel through 4.10.10 does not properly enforce the CONFIGSTRICTDEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte and bypass slab-allocation access restrictions via an application that opens the...

CVE-2017-5456

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR 52.1 and Firefox 53...

Directory traversal

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames...

DEBIAN-CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions...

IoT Botnets Found Using Default Credentials for C&C Server Databases

Not following cybersecurity best practices could not only cost online users but also cost cybercriminals. Yes, sometimes hackers don't take best security measures to keep their infrastructure safe. A variant of IoT botnet, called Owari , that relies on default or weak credentials to hack insecure...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

Exploit for Improper Input Validation in Flexense Syncbreeze

Flexense HTTP Server Server-Enable web server on port. Module...

Microsoft Windows: Removable Disks: Deny write access

This test checks the setting for policy OpenVAS Vulnerability Test $Id: windisksdenywriteaccess.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Removable Disks: Deny write access Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...

Microsoft Windows: WPD Devices: Deny write access

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winwpddenywriteaccess.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for WPD Devices: Deny write access Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program ...

Microsoft Windows: All Removable Storage classes: Deny all access

This test checks the setting for policy OpenVAS Vulnerability Test $Id: windenyallaccessremovablestorage.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for All Removable Storage classes: Deny all access Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: CD and DVD: Deny write access

This test checks the setting for policy OpenVAS Vulnerability Test $Id: wincddvddenywriteaccess.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for CD and DVD: Deny write access Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program...

Directory traversal

Syntastic aka vim-syntastic through 3.9.0 does not properly handle searches for configuration files it searches the current directory up to potentially the root. This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a...

CVE-2018-11319

Syntastic aka vim-syntastic through 3.9.0 does not properly handle searches for configuration files it searches the current directory up to potentially the root. This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a...

CVE-2018-11319

Syntastic aka vim-syntastic through 3.9.0 does not properly handle searches for configuration files it searches the current directory up to potentially the root. This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a...

DEBIAN-CVE-2018-11319

Syntastic aka vim-syntastic through 3.9.0 does not properly handle searches for configuration files it searches the current directory up to potentially the root. This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a...