6976 matches found
CVE-2017-1407: Improper Neutralization of Special Elements used in a Command
IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID:...
Security vulnerabilities fixed in Firefox ESR 52.4 — Mozilla
A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications ARIA elements...
Broadcom 802.11r (FT) Reassociation Response Overflows Vulnerability
Broadcom suffers from multiple overflow vulnerabilities when handling 802.11r FT Reassociation Response. Broadcom: Multiple overflows when handling 802.11r FT Reassociation Response CVE-2017-11121 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. Thes...
The Great DOM Fuzz-off of 2017
Posted by Ivan Fratric, Project Zero Introduction Historically, DOM engines have been one of the largest sources of web browser bugs. And while in the recent years the popularity of those kinds of bugs in targeted attacks has somewhat fallen in favor of Flash which allows for cross-browser exploi...
[SECURITY] Fedora 26 Update: gtatool-2.2.0-6.fc26
Gtatool is a command line tool to manipulate GTAs. It provides a set of commands that manipulate GTAs on various levels: array element components, array dimensions, whole arrays, and streams of ar rays. For example, you can add components to array elements, merge separate arrays into combined...
USN-3424-1: libxml2 vulnerabilities
It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. CVE-2017-0663 It was discovered that libxml2 did not properly validate parsed entity references. An...
Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities
The version of libxml2 packaged with Nokogiri contains several vulnerabilities. Nokogiri has mitigated these issues by upgrading to libxml 2.9.5. It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial ...
CVE-2017-14500
Removed by vendor...
The vulnerability of the mnt_ping.cgi service in the microprogramming software of the Technicolor TD5336 router allows a hacker to execute arbitrary operating system commands with superuser privileges.
The vulnerability of the mntping.cgi service in the microprogramming software of the Technicolor TD5336 router exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitra...
DEBIAN-CVE-2017-12987
The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-80211.c:parseelements...
Tcpdump IEEE 802.11 parser buffer overflow vulnerability (CNVD-2017-27744)
Tcpdump is a set of sniffing tools developed by the Tcpdump team that run under the command line. The tool allows users to intercept and display TCP/IP and other packets sent or received over a network connection to that computer.IEEE 802.11 parser is one of the IEEE 802.11 standard parsers. A...
UBUNTU-CVE-2017-13008
The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-80211.c:parseelements...
PT-2017-12826
Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.2 Description The issue is related to a buffer over-read in the IEEE 802.11 parser, specifically in the parse elements function within print-802 11.c. This could allow a remote attacker to obtain sensitive...
PT-2017-12848
Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.2 Description The issue is related to a buffer over-read in the IEEE 802.11 parser, specifically in the parse elements function within print-802 11.c. This could allow a remote attacker to obtain sensitive...
Mozilla: Out-of-bounds read with cached style data and pseudo-elements (MFSA 2017-19)
An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...
Microsoft Edge DOMAttrModified Type Confusion Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of t...
Trend Micro Smart Protection OS Command Injection
1. Advisory Information Title: Trend Micro Smart Protection OS Command Injection Advisory ID: CORE-2017-0004 Advisory URL:http://www.coresecurity.com/core-labs/advisories/trend-micro-smart-protection-os-command-injection Date published: 2017-08-23 Date of last update: 2017-08-23 Vendors contacted...
CVE-2016-2102
HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network...
