2677 matches found
ex-NSA Hacker Discloses macOS High Sierra Zero-Day Vulnerability
Your Mac computer running the Apple's latest High Sierra operating system can be hacked by tweaking just two lines of code, a researcher demonstrated at the Def Con security conference on Sunday. Patrick Wardle, an ex-NSA hacker and now Chief Research Officer of Digita Security, uncovered a...
DEF CON 2018: Apple 0-Day (Re)Opens Door to ‘Synthetic’ Mouse-Click Attack
LAS VEGAS – By tweaking just two lines of code, a researcher stumbled on an Apple zero-day that could allow a local attacker to virtually “click” a security prompt and thus load a kernel extension on systems running Apple’s latest High Sierra operating system. Kernel access on a Mac gives an...
Click Studios Passwordstate Cross-Site Scripting Vulnerability
Click Studios Passwordstate is a web-based password manager from Click Studios Australia. A cross-site scripting vulnerability exists in versions prior to Click Studios Passwordstate 8.3 Build 8397. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via ...
CVE-2016-8527
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting XSS. The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking ...
ThreatList: Spam’s Revival is Tied to Adobe Flash’s Demise
Spam click-rates are up in 2018. Last year, 13.4 percent of spam messages that made it into inboxes were clicked on. So far, in 2018 that percentage has jumped to 14.2 percent. The numbers come from F-Secure, which reported Wednesday on the sorry state of users’ better judgment when it comes to...
Hardcoded credentials
Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document...
CVE-2018-14776
Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document...
CVE-2018-14776
CVE-2018-14776 affects Click Studios Passwordstate (web-based password manager) prior to version 8.3 Build 8397. The vulnerability is an authenticated-user cross-site scripting (XSS) flaw triggered by uploading an HTML document, enabling injection of arbitrary script when viewed by other authenti...
CVE-2018-14776
Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document...
CVE-2017-3210
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the...
CVE-2017-3210
The CVE-2017-3210 issue affects Portrait Displays SDK services where pdiservice.exe runs with NT AUTHORITY/SYSTEM permissions and is writable by all Authenticated Users, enabling local privilege escalation. Affected applications include Portrait Display SDK-based tools such as Fujitsu DisplayView...
CVE-2017-3210 Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the...
Microsoft Office 2016 Click-to-Run (C2R) Multiple Vulnerabilities (Jul 2018)
This host is missing an important security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
TP-LINK TL-WR841N Standalone Hijacking Vulnerability
TP-LINK TL-WR841N is a wireless router product from China P&L TP-LINK. A security vulnerability exists in the TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n version. An attacker can exploit the vulnerability to hijack a click operation and cause the user to perform a...
Microsoft Windows 10: Adobe Flash Click-to-Run (Edge)
This test checks the setting for policy OpenVAS Vulnerability Test $Id: winedgeadobeclick2run.nasl 11344 2018-09-12 06:57:52Z emoss $ Check value for Configure the Adobe Flash Click-to-Run setting Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net...
Security Bulletin: IBM Cloud Event Management is affected by a security vulnerability when using Microsoft Internet Explorer (CVE-2018-1365)
Summary IBM Cloud Event Management is affected by one or more security vulnerabilities. When using Internet Explorer, Cloud Event Management can be loaded in to an iframe that is not part of the Cloud Event Management system. If you do not load Cloud Event Management directly, your session might ...
Security Bulletin: IBM Alert Notification is affected by a security vulnerability when using Microsoft Internet Explorer (CVE-2018-1365)
Summary IBM Alert Notification is affected by one or more security vulnerabilities. When using Internet Explorer, Alert Notification can be loaded in to an iframe that is not part of the Alert Notification system. If you do not load Alert Notification directly, your session might be intercepted...
Security Bulletin: Multiple security vulnerabilities affect the Lifecycle Query Engine (LQE) that is shipped with Jazz Reporting Service (CVE-2016-0316, CVE-2016-0317, CVE-2016-0318, CVE-2016-0319)
Summary There are multiple security vulnerabilities in the Lifecycle Query Engine LQE shipped with Jazz Reporting Service. Vulnerability Details CVEID: CVE-2016-0316 DESCRIPTION: IBM Jazz Reporting Service is vulnerable to cross-site scripting, caused by improper validation of user-supplied input...
Security Bulletin: A Security Vulnerability was fixed in IBM Security Privileged Identity Manager (CVE-2016-0357)
Summary IBM Security Identity Manager Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim Vulnerability Details CVEID: CVE-2016-0357 DESCRIPTION: IBM Security Identity Manager Virtual Appliance could allow a remote attacker to hijack the clicking action of...
Security Bulletin: Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services
Summary Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services. Note the description says ACH Services but the vulnerabilities also apply to Check and CPS. Vulnerability Details CVEID: CVE-2016-0253 DESCRIPTION: IBM Financial...