Microsoft Windows - CiSetFileCache TOCTOU Incomplete Fix

Microsoft Windows - CiSetFileCache TOCTOU Incomplete Fix Windows: CiSetFileCache TOCTOU CVE-2017-11830 Incomplete Fix Platform: Windows 10 1709 including Win10S Class: Security Feature Bypass Summary: The fix for CVE-2017-11830 is insufficient to prevent a normal user application adding a cached...

Microsoft Windows - 'CiSetFileCache' TOCTOU Incomplete Fix

Windows: CiSetFileCache TOCTOU CVE-2017-11830 Incomplete Fix Platform: Windows 10 1709 including Win10S Class: Security Feature Bypass Summary: The fix for CVE-2017-11830 is insufficient to prevent a normal user application adding a cached signing level to an unsigned file by exploiting a TOCTOU ...

UBUNTU-CVE-2018-9918

libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service stack exhaustion, related to the QPDFObjectHandle and QPDFDictionary classes, because nesting in direct objects is not restricted...

tcpdump: Buffer over-read in print-ppp.c:handle_mlppp() in PPP parser

The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handlemlppp...

PT-2018-5569

Name of the Vulnerable Software and Affected Versions: Android versions 6.0 through 8.1 Description: The issue is related to an out of bounds read in the sdp server handle client req function due to a missing bounds check. This could lead to local information disclosure without requiring addition...

Buffer overflow

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in wmavdevstartresphandler, vdev id is received from firmware as part of WMIVDEVSTARTRESPEVENTID. This vdev id can be greater than max...

March 22, 2018—KB4089848 (OS Build 16299.334)

None None...

March 1, 2018—KB4091290

None None...

NoMachine 6.0.80 (x64) - nxfuse Privilege Escalation

NoMachine 6.0.80 x64 - nxfuse Privilege Escalation from ctypes import from ctypes.wintypes import import struct import sys import os MEMCOMMIT = 0x00001000 MEMRESERVE = 0x00002000 PAGEEXECUTEREADWRITE = 0x00000040 GENERICREAD = 0x80000000 GENERICWRITE = 0x40000000 OPENEXISTING = 0x3...

February 13, 2018—KB4074598 (Monthly Rollup)

None None...

UBUNTU-CVE-2017-12376

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking...

ALPINE-CVE-2017-12376

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking...

AsusWRT router/httpd/httpd.c file access bypass vulnerability

ASUS AsusWRT is a set of router operating systems from ASUS. A security vulnerability exists in the 'handlerequest' function of the router/httpd/httpd.c file in versions prior to ASUS AsusWRT 3.0.0.4.38410007. An attacker can exploit this vulnerability to execute a POST request...

Keybase: Claiming ownership of GitHub handles via forked GitHub gists.

Description An attacker can claim ownership of a GitHub user's handle if the user forks the attacker's gist with a verification snippet generated by the attacker pointing towards the user's handle. PoC With my colleague's permission @jackds I claimed their GitHub handle with this gist:...

January 19, 2018—KB4057400 (Preview of Monthly Rollup)

None None...

DarkComet (C2 Server) - File Upload

!/usr/bin/env python3 EDB Note: Source https://gist.github.com/PseudoLaboratories/260b6f24844785aacc1e2fb61dd05c01/259944bd94a0d289ef80b9138c1e3f97a97aa9cd from time import sleep from socket import socket, AFINET, SOCKSTREAM, error from re import search from Crypto.Cipher import ARC4 from binasci...

Denial of Service Vulnerability in ForceControl V7.2 Product NetServer.exe

ForceControl is the configuration software developed by ForceControl Technology for the general monitoring and control configuration software market. As the basic platform software in industrial automation software, ForceControl can provide solutions for all kinds of industries. A denial of servi...

Memory corruption

ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due t...

EasySNS Minimalist Community loginHandle method suffers from SQL injection vulnerability

EasySNS Minimalist Community is for the new database architecture and program structure, to the group as the basic unit to form an interactive community. A SQL injection vulnerability exists in the loginHandle method of the EasySNS community. The vulnerability is due to the failure of the system ...

Microsoft Windows win32k Menu Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...