7080 matches found
Core: DoS via bad certificate
.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET COR...
BankBot Returns On Play Store – A Never Ending Android Malware Story
Even after so many efforts by Google for making its Play Store away from malware, shady apps somehow managed to fool its anti-malware protections and infect people with malicious software. A team of researchers from several security firms has uncovered two new malware campaigns targeting Google...
Seamless Flags Configuration for Epic Hyperspace
This article includes recommended configuration for specific issues that may be encountered in your EpicHyperspace via CVAD deployment. These configurations should only be used if you encounter the specific issue mentioned. Before determining whether or not you will use any of these configuration...
CVE-2017-16849
CVE-2017-16849 affects Zoho ManageEngine Applications Manager 13 prior to build 13530. The vulnerability is a SQL injection in the MyPage.do?method=viewDashBoard forpage parameter, enabling unauthorized arbitrary SQL execution. The NVD entry cites a CVSS3 base score of 9.8 (CRITICAL) with network...
Huawei Enjoy 6 MTK Platform Arbitrary Memory Access Vulnerability
The Huawei Enjoy 6 is a smartphone from the Chinese company Huawei Huawei. The Huawei Enjoy 6 MTK platform suffers from an arbitrary memory access vulnerability, which can be used by attackers to trick users into installing malicious apps, which can be exploited to send specific parameters leadin...
Huawei Enjoy 6 MTK Platform Arbitrary Memory Access Vulnerability (CNVD-2017-34227)
The Huawei Enjoy 6 is a smartphone from the Chinese company Huawei Huawei. The Huawei Enjoy 6 MTK platform suffers from an arbitrary memory access vulnerability, which can be used by attackers to trick users into installing malicious apps, which can be exploited to send specific parameters leadin...
CVE-2017-11883
.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability"...
New Android Trojan malware discovered in Google Play
A new piece of mobile malware has been discovered in Google Play masquerading as multiple apps: an alarm clock app, a QR scanner app, a compass app, a photo editor app, an Internet speed test app, and a file explorer app. According to Google Play data, all were last updated between October and...
Microsoft Office Web Apps 2010 Service Pack 2 Defense in Depth Update (KB4011271)
This host is missing an important security update according to Microsoft KB4011271 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Microsoft Office Web Apps Server 2013 Service Pack 1 Defense in Depth Vulnerability (KB4011247)
This host is missing an important security update according to Microsoft KB4011247 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Security Update for Microsoft Office Web Apps Server 2013 (KB4011247) farm-deployment
A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...
Security Update for Microsoft Office Web Apps Server 2013 (KB4011247)
A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...
Implementing the CIS 20 Critical Security Controls: Slash Risk of Cyber Attacks by 85%
If a CISO needed to cut cyber attack risk by 85%, how would this security chief go about accomplishing that? Would the CISO even know where to begin? It’s safe to say that such a mandate would be considered daunting, and maybe even overwhelming. CISOs are scrambling to protect IT infrastructures...
Description of the security update for Project Server 2013: November 14, 2017
Description of the security update for Project Server 2013: November 14, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...
Description of the security update for SharePoint Server 2010 Office Web Apps: November 14, 2017
Description of the security update for SharePoint Server 2010 Office Web Apps: November 14, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these...
Security Updates for Microsoft Office Web Apps (November 2017)
The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office...
Design/Logic Flaw
An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involves the "Kernel" component. It allows attackers to monitor arbitrary apps via a crafted app that accesses...
IRCCloud: [IRCCloud Android] Theft of arbitrary files leading to token leakage
Bug description Hi, I'd like to report a vulnerability which allows to theft arbitrary protected files and as a result takeover account, because all tokens will be leaked, similar to my bug reported to Harvest https://hackerone.com/reports/161710 This one is really tricky, passed two days to...
Eavesdropper Vulnerability Exposes Mobile Call, Text Data
UPDATE Mobile app developers who code using the Twilio cloud-based platform and are forgetful about removing their hardcoded credentials have put businesses messaging data at risk for exposure. The so-called Eavesdropper vulnerability, disclosed today by Appthority, has been around since 2011 and...