CVE-2018-17613

CVE-2018-17613 affects Telegram Desktop (tdesktop) 1.3.16 alpha. When “Use proxy” is enabled, it transmits credentials and application data in cleartext over the SOCKS5 protocol. The description does not provide exploit details, affected versions beyond 1.3.16 alpha, or any remediation in place w...

PT-2018-14085

Name of the Vulnerable Software and Affected Versions Telegram Desktop aka tdesktop version 1.3.16 alpha Description The issue concerns the transmission of sensitive data in cleartext when a specific setting is enabled. Specifically, when "Use proxy" is enabled, credentials and application data a...

UBUNTU-CVE-2018-14780

An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function ykpivfetchobject: % highlight c % ifsw == SWSUCCESS sizet outlen; int offs = ykpivgetlengthdata + 1, &outlen; ifoffs == 0 return YKPIVSIZEERROR;...

New Man-in-the-Disk attack leaves millions of Android phones vulnerable

Security researchers at Check Point Software Technologies have discovered a new attack vector against the Android operating system that could potentially allow attackers to silently infect your smartphones with malicious apps or launch denial of service attacks. Dubbed Man-in-the-Disk , the attac...

Reconnaissance and Vulnerability Scanning Tool: Raccoon

Raccoon is a tool made for reconnaissance and information gathering with an emphasis on simplicity. It will do everything from fetching DNS records, retrieving WHOIS information, obtaining TLS data, detecting WAF presence and up to threaded dir busting and subdomain enumeration. Every scan output...

Denial of service in django

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service resource consumption via a URL associated with...

CVE-2018-10647

SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service. The "SaferVPN.Service" service executes "openvpn.exe" using OpenVPN config files located within the current user's %LOCALAPPDATA%\SaferVPN\OvpnConfig directory. An authenticated...

CVE-2018-2374: Undefined Security Weakness

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space...

PT-2018-4294

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description The issue concerns the backup mechanism in the Android Debug Bridge adb tool, which may allow attackers to inject and execute arbitrary code by exploiting a failure to filter application data...

CVE-2017-15896

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSLread due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption...

CVE-2017-9797

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of...

Dashlane Local Privilege Vulnerability

Dashlane is a system security software for the mobile platform from Dashlane Inc. There is a security vulnerability in Dashlane. A local attacker can exploit this vulnerability by placing the WINHTTP.dll file in the %APPDATA%Dashlane directory...

CVE-2017-0602

An information disclosure vulnerability in Bluetooth could allow a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as Moderate due to details specific to the vulnerability. Product: Android. Versions:...

CVE-2016-5059

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Containers/Data/Application...

PT-2017-10559

Name of the Vulnerable Software and Affected Versions Android versions 6.0 through 7.1.1 Description An information disclosure issue in AOSP Messaging could allow a local malicious application to bypass operating system protections, potentially gaining access to isolated application data. This...

PT-2017-10560

Name of the Vulnerable Software and Affected Versions Android versions 6.0 through 7.1.1 Description An information disclosure issue in AOSP Messaging could allow a local malicious application to bypass operating system protections, potentially gaining access to isolated application data. This...

PT-2016-7070

Name of the Vulnerable Software and Affected Versions Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-11-01 Android versions 7.0 before 2016-11-01 Description An information disclosure issue in the download manager could allow a local...

[SECURITY] Fedora 23 Update: kf5-knewstuff-5.24.0-1.fc23

KDE Frameworks 5 Tier 3 module for downloading and sharing additional application data like plugins, themes, motives, etc...

[SECURITY] Fedora 24 Update: kf5-knewstuff-5.24.0-1.fc24

KDE Frameworks 5 Tier 3 module for downloading and sharing additional application data like plugins, themes, motives, etc...

Microsoft Windows Cipher Suites For FalseStart MiTM Vulnerability (3155527)

This host is missing a security update according to Microsoft Security Advisory 3155527 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...