CVE-2017-3746

CVE-2017-3746 affects the ThinkPad USB 3.0 Ethernet Adapter driver for part number 4X90E51405. The vulnerability is a local privilege-escalation weakness that could let a local user execute arbitrary code with administrative or system-level privileges. Multiple sources (NVD entry and Lenovo secur...

CVE-2017-3746

ThinkPad USB 3.0 Ethernet Adapter part number 4X90E51405 driver, various versions, was found to contain a privilege escalation vulnerability that could allow a local user to execute arbitrary code with administrative or system level privileges...

ThinkPad USB 3.0 Ethernet Adapter Driver Privilege Escalation - Lenovo Support US

No description provided...

ThinkPad USB 3.0 Ethernet Adapter Driver Privilege Escalation - us

Lenovo Security Advisory: LEN-9896 Potential Impact: Privilege escalation and executable files without a valid signature Severity: High Scope of Impact: Lenovo Specific CVE Identifier: CVE-2017-3746 Summary Description: During an internal analysis, the ThinkPad USB 3.0 Ethernet Adapter part numbe...

Create a Fake AP and Sniff Data: mitmAP

A python program to create a fake AP and sniff data new in 2.0: SSLstrip2 for HSTS bypass Image capture with Driftnet TShark for command line .pcap capture Features: SSLstrip2 Driftnet Tshark Full featured access point, with configurable speed limit mitmproxy Wireshark DNS Spoofing Saving results...

Session Fixation

keycloak-servlet-filter-adapter is vulnerable to session fixation attacks. The library does not assign a new session ID whenever a user authenticates, allowing a malicious user to reuse session IDs to impersonate another user...

Microsoft Windows Kernel - IOCTL 0x120007 NsiGetParameter nsiproxynetio Pool Memory Disclosure

Microsoft Windows Kernel - IOCTL 0x120007 NsiGetParameter nsiproxynetio Pool Memory Disclosure / We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys \.\Nsi device discloses portions of uninitialized pool memory to user-mode clients, likely due to output structure alignment...

RHEL 7 : kernel (RHSA-2017:1615)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1615 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A flaw was found in the way Linux kern...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20170628)

Security Fixes : - A flaw was found in the way Linux kernel allocates heap memory to build the scattergather list from a fragment listskbshinfoskb-fraglist in the socket bufferskbbuff. The heap overflow occurred if 'MAXSKBFRAGS - 1' parameter and 'NETIFFFRAGLIST' feature were used together. A...

Portable Virtual Private Network: goSecure

Portable Virtual Private Network goSecure is an easy to use and portable Virtual Private Network VPN solution. The system consists of a single server and one or many clients. strongSwan is used to establish a Suite B IPsec tunnel with pre-shared keys between the server and clients. The core crypt...

Privilege Escalation

keycloak-spring-boot-adapter is susceptible to privilege escalation attacks. It is due to a flaw in the loop of KeycloakSpringBootConfiguration.java, granting admin access to normal user instead of using the security constraints as intended when Tomcat is used for Spring...

CVE-2017-4903

VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8...

Red Hat Keycloak Node.js adapter authentication bypass vulnerability

Red Hat Keycloak Node.js adapter Red Hat's open source set of Node.js adapters for authentication and access management software in modern applications and services. A security vulnerability exists in Red Hat Keycloak Node.js adapter versions 2.5 through 3.0, which stems from the program failing ...

CVE-2017-7474

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks...

CVE-2017-7474

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks...

CVE-2017-7474

CVE-2017-7474 affects the Keycloak Node.js adapter (versions 2.5–3.0). The root cause is improper handling of invalid tokens, which could allow an attacker to bypass authentication and access restricted information, or conduct further attacks. Public references describe this as an authentication ...

CVE-2017-7474

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks...

Qemu: cirrus: heap buffer overflow via vnc connection

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash...

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update E)

CVSS v3 6.5 ATTENTION: Exploitable from an adjacent network/low skill level to exploit. Vendor: Siemens Equipment: Devices using the PROFINET Discovery and Configuration Protocol DCP Vulnerability: Denial of Service UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory...

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update F)

CVSS v3 6.5 ATTENTION: Exploitable from an adjacent network/low skill level to exploit. Vendor: Siemens Equipment: Devices using the PROFINET Discovery and Configuration Protocol DCP Vulnerability: Denial of Service UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory...