CVE-2018-10712

The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run co...

CVE-2018-10711

The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write Machine Specific Registers MSRs. This could be leveraged to execute arbitrary ring-...

CVE-2018-10709

The CVE-2018-10709 entry concerns ASRock drivers: AsrDrv101.sys/AsrDrv102.sys in ASRock RGBLED, A-Tuning, F-Stream, RestartToUEFI. The described vulnerability arises from IOCTL interfaces that expose read/write access to CR register values, enabling local privilege escalation and potential code e...

CVE-2018-10711

The CVE-2018-10711 entry concerns ASRock driver components AsrDrv101.sys and AsrDrv102.sys used by ASRock RGBLED, A-Tuning, F-Stream, and RestartToUEFI. The driver versions listed expose functionality to read/write Machine Specific Registers (MSRs), enabling execution of arbitrary ring-0 code on ...

CVE-2018-10710

The CVE-2018-10710 entry concerns ASRock drivers: AsrDrv101.sys and AsrDrv102.sys in ASRock RGBLED, A-Tuning, F-Stream, and RestartToUEFI expose IOCTLs that read/write arbitrary physical memory. This enables local privilege escalation by a user with low privileges. Affected versions are ASRock RG...

kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4xattrsetentry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image...

Fallout Exploit Kit Releases the Kraken Ransomware on Its Victims

ARCHIVED STORY Fallout Exploit Kit Releases the Kraken Ransomware on Its Victims By John Fokker · October 30, 2018 Alexandr Solad and Daniel Hatheway ofRecorded Future are coauthors of this post. Read Recorded Future’s version of this analysis. Rising from the deep, Kraken Cryptor ransomware has...

Fallout Exploit Kit Releases the Kraken Ransomware on Its Victims

ARCHIVED STORY Fallout Exploit Kit Releases the Kraken Ransomware on Its Victims By John Fokker · October 30, 2018 Alexandr Solad and Daniel Hatheway of Recorded Future are coauthors of this post. Read Recorded Future’s version of this analysis. Rising from the deep, Kraken Cryptor ransomware has...

rencontre-a-lyon.fr XSS vulnerability

Open Bug Bounty ID: OBB-691581 Description| Value ---|--- Affected Website:| rencontre-a-lyon.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Shell In A Box 2.2.0 Denial Of Service Exploit

Exploit for linux platform in category dos / poc Product: Shell In A Box aka shellinabox, shellinaboxd "Shell In A Box implements a web server that can export arbitrary command line tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser a...

ASRock Drivers Privilege Escalation / Code Execution

SecureAuth - SecureAuth Labs Advisory http://www.secureauth.com/ ASRock Drivers Elevation of Privilege Vulnerabilities 1. Advisory Information Title: ASRock Drivers Elevation of Privilege Vulnerabilities Advisory ID: CORE-2018-0005 Advisory URL:...

Shell In A Box 2.2.0 Denial Of Service

Product: Shell In A Box aka shellinabox, shellinaboxd "Shell In A Box implements a web server that can export arbitrary command line tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser and does not require any additional browser plugin...

Ubuntu: Security Advisory (USN-3428-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Here Comes Wallarm

Today we are happy to announce the closing of $8 Million Series A financing. After talking with many venture firms in California, we decided to partner up with Toba Capital, a firm with an excellent understanding of the enterprise market and previous successful investments in security, such as...

SUSE SLES12 Security Update : wireshark (SUSE-SU-2018:2891-2)

This update for wireshark to version 2.4.9 fixes the following issues : Wireshark was updated to 2.4.9 bsc1094301, bsc1106514. Security issues fixed : CVE-2018-16058: Bluetooth AVDTP dissector crash wnpa-sec-2018-44 CVE-2018-16056: Bluetooth Attribute Protocol dissector crash wnpa-sec-2018-45...

School ERP Ultimate 2018 - Arbitrary File Download

School ERP Ultimate 2018 - Arbitrary File Download Exploit Title: School ERP Ultimate 2018 - Arbitrary File Download Dork: N/A Date: 2018-10-21 Exploit Author: Ihsan Sencan Vendor Homepage: http://freeschoolerp.com/ Software Link: http://freeschoolerp.com/schoolerp30Nov2017free.zip Software Link:...

p-a-i.de XSS vulnerability

Open Bug Bounty ID: OBB-687687 Description| Value ---|--- Affected Website:| p-a-i.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

CVE-2018-14917

This CVE entry is rejected; the candidate was withdrawn and does not represent a security issue.

city-nagasaki-a-bomb-museum-db.jp XSS vulnerability

Open Bug Bounty ID: OBB-685363 Description| Value ---|--- Affected Website:| city-nagasaki-a-bomb-museum-db.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6...

a-b-s.de XSS vulnerability

Open Bug Bounty ID: OBB-685159 Description| Value ---|--- Affected Website:| a-b-s.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...