Cambium Networks cnPilot Elevation of Privilege Vulnerability

Cambium Networks cnPilot is a cloud-enabled managed single-band router product from Cambium Networks, USA. A security vulnerability exists in Cambium Networks cnPilot using firmware version 4.3.2-R4 and earlier. An attacker can exploit the vulnerability to obtain sensitive information usernames a...

OpenCV: Multiple vulnerabilities

Background OpenCV Open Source Computer Vision Library is an open source computer vision and machine learning software library. Description Multiple vulnerabilities have been discovered in OpenCV. Please review the referenced CVE identifiers for details. Impact An attacker can cause a denial of...

Mobotap Dolphin Browser for Android URI Scheme Resolution Vulnerability

Mobotap Dolphin Browser for Android is a web browser for the Android platform from MoboTap. A security vulnerability exists in version 12.0.2 of Dolphin Browser for Android. The vulnerability can be exploited to call private activities in Dolphin Browser via malicious URIs...

HOT Man Android App Has Information Leakage Vulnerability

HOT Man Android APP is a mobile magazine software. There is an information leakage vulnerability in HOT Man Android APP. After registering and logging in to the system, an attacker can obtain sensitive information such as other users' UIDs, names, and cell phone numbers by clicking on "My Avatar"...

CVE-2017-1487

IBM Sterling File Gateway 2.2 could allow an authenticated attacker to obtain sensitive information such as login ids on the system. IBM X-Force ID: 128626...

Growatt Monitoring System Android App Multiple Override Access Vulnerabilities

Growatt Monitoring System Android APP is a client application that provides PV monitoring services. Growatt Monitoring System Android APP has overstepped access vulnerabilities in multiple places. Attackers can obtain sensitive information, including: power plant equipment information, name, powe...

About the security content of tvOS 11.2

About the security content of tvOS 11.2 This document describes the security content of tvOS 11.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

MGASA-2017-0423 Updated chromium-browser-stable packages fix security issues

Chromium-browser 62.0.3202.94 fixes security issues: Multiple flaws were found in the way Chromium 60 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information...

Apple iOS 11.1.1 kernel DoS Exploit

A logic issue in the allocation of address space identifiers exists. An attacker can cause a denial of service from within a sandboxed process. Usage Info An attacker can use this exploit to cause a denial of service in the kernel This is private exploit. You can buy it at https://0day.today...

LibXfont, LibXfont2: Multiple vulnerabilities

Background X.Org Xfont library Description Multiple vulnerabilities have been discovered in LibXfont and LibXfont2. Please review the referenced CVE identifiers for details. Impact Local attackers could obtain sensitive information or possibly cause a Denial of Service condition. Workaround There...

libxml2: Multiple vulnerabilities

Background libxml2 is the XML eXtended Markup Language C parser and toolkit initially developed for the Gnome project. Description Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user...

Simple Banking Security Tip: Verbal Passwords

There was a time when I was content to let my bank authenticate me over the phone by asking for some personal identifiers SSN/DOB that are broadly for sale in the cybercrime underground. At some point, however, I decided this wasn't acceptable for institutions that held significant chunks of our...

CloudBees GitHub Branch Source plugin enumeration vulnerability

CloudBees GitHub Branch Source plugin is the U.S. CloudBees company's Jenkins Java-based development of continuous integration tools in a GitHub branch plugin . The CloudBees GitHub Branch Source plugin suffers from an enumeration vulnerability that stems from the program failing to detect...

CloudBees Docker Commons Plugin Information Disclosure Vulnerability

CloudBees Docker Commons Plugin is an API sharing plugin in Jenkins a continuous integration tool based on Java development from the US company CloudBees. An information disclosure vulnerability exists in the CloudBees Docker Commons Plugin that stems from the program failing to detect privileges...

CVE-2017-5075

Inappropriate implementation in CSP reporting in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to obtain the value of url fragments via a crafted HTML page...

The vulnerability of the Locator/ID Separation (LISP) protocol implementation in Cisco IOS allows a hacker to bypass the authentication process.

The vulnerability of the Locator/ID Separation LISP protocol implementation in Cisco IOS is related to defects in the authentication process logical error. Exploiting this vulnerability allows a malicious actor to bypass the authentication process by using special registration requests that trigg...

WordPress uDesign Theme Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports the PHP and MySQL servers to set up a personal blog site. uDesign aka U-Design is one of the theme plug-ins. A cross-site scripting vulnerability exists in WordPress...

Inedo ProGet Design Vulnerability

Inedo ProGet is a general-purpose package manager from Inedo Japan with package management, filtering and upgrading features. A security vulnerability exists in Inedo ProGet versions prior to 4.7.14, which stems from the program's failure to properly handle malicious packet IDs.No information is...

UBUNTU-CVE-2017-7813

Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. This...

TouTou Shared Bike Android APP has an override access vulnerability

TouTou Shared Bike Android APP is a shared bike travel software for cities. TouTou Shared Bicycle Android APP has an override access vulnerability. After registering and logging into the system, the attacker can modify the user ID by grabbing packets to view any account information, including:...