DEBIAN-CVE-2017-2825

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this...

UBUNTU-CVE-2017-2825

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this...

CVE-2017-2825

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this...

CVE-2017-2825

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this...

Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege

Posted by James Forshaw, Project Zero Previously I presented a technique to exploit arbitrary directory creation vulnerabilities on Windows to give you read access to any file on the system. In the upcoming Spring Creators Update RS4 the abuse of mount points to link to files as I exploited in th...

kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation

A bug in the 32-bit compatibility layer of the ioctl handling code of the v4l2 video driver in the Linux kernel has been found. A memory protection mechanism ensuring that user-provided buffers always point to a userspace memory were disabled, allowing destination address to be in a kernel space...

CVE-2018-6547

playsservice.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, contains an HTTP message parsing function that takes a user-defined path and writes non-user controlled data as SYSTEM to the file when the extractfiles...

CVE-2017-0359

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive...

Allen Bradley Micrologix 1400 Series B FRN Access Control Vulnerability (CNVD-2018-08283)

Allen Bradley Micrologix 1400 Series B FRN is a programmable logic controller from Rockwell Automation. An access control vulnerability exists in the data, program, and function file permissions functions in the Allen Bradley Micrologix 1400 Series B FRN version 21.2 and earlier. Since values 0x0...

The vulnerability of AMD Secure Processor technology in Ryzen and Ryzen Pro processors allows for reading from the protected area of the processor.

The vulnerability of AMD Secure Processor-based Ryzen and Ryzen Pro processors lies in the implementation flaws of security functions. Exploiting this vulnerability allows an attacker with access to the targeted computer and administrative privileges to read from the protected areas of the...

The vulnerability in the implementation of AMD Secure Processor technology in Ryzen and Ryzen Pro processors allows for the disabling of System Management Mode protection.

The vulnerability of AMD Secure Processor-based Ryzen and Ryzen Pro processors lies in the implementation flaws of security functions. Exploiting this vulnerability allows an attacker with access to the targeted computer and administrative privileges to disable the System Management Mode SMM...

Apache HTTP Server mod_authnz_ldap Denial of Service Vulnerability

Apache httpd is the U.S. Apache Apache Software Foundation, an open source HTTP server developed and maintained specifically for modern operating systems. A security vulnerability exists in modauthnzldap in Apache httpd versions 2.0.23 through 2.0.65, 2.2.0 through 2.2.34, and 2.4.0 through 2.4.2...

Code execution vulnerability in hao6cms v2.0 config_edit.asp file

hao6cms is an enterprise website management system. A code execution vulnerability exists in the hao6cms v2.0 configedit.asp file. The vulnerability is due to the parameters failed to filter the direct splicing written to the configuration file, an attacker can exploit the vulnerability to obtain...

The vulnerability of the rds_message_alloc_sgs() function in the Linux operating system allows a hacker to perform write operations beyond the buffer boundaries in memory.

The vulnerability of the rdsmessageallocsgs function in the Linux operating system is related to insufficient checks on the data used by the direct memory access mechanism. Exploiting this vulnerability could allow an attacker to write data beyond the buffer boundaries in memory...

CVE-2018-1000079

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to...

UBUNTU-CVE-2018-1000079

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to...

Broadcom BCM43xx Wi-Fi - BroadPWN Denial of Service Exploit

Exploit for Android platform in category dos / poc This Exploit allows arbitrary memory writes and reads. Running the specified payload within this package will write to the device's main CPU kernel, causing it to crash. More information about its origins here: http://boosterok.com/blog/broadpwn2...

NVIDIA SHIELD TV Tegra Kernel Driver NVMAP Elevation of Privilege Vulnerability

NVIDIA SHIELD TV is a gaming console device from NVIDIA Corporation.Tegra kernel driver is one of the Tegra processor kernel drivers.NVMAP is one of the components of... A security vulnerability exists in the NVMAP of the Tegra kernel driver in NVIDIA SHIELD TV SE 6.2 and earlier versions. An...

Unspecified Vulnerability in Micro Focus openSUSE

Micro Focus openSUSE is a Linux-based free operating system from Micro Focus in the UK. openSUSE Leap is a version of openSUSE. A security vulnerability exists in the build package of Micro Focus openSUSE Leap, which stems from the program's failure to validate directory names. An attacker could...

[ASA-201803-2] mkinitcpio-busybox: arbitrary code execution

Arch Linux Security Advisory ASA-201803-2 ========================================= Severity: High Date : 2018-03-01 CVE-ID : CVE-2017-16544 Package : mkinitcpio-busybox Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-514 Summary ======= The package...