6659 matches found
Oracle Java SE Security Updates (oct2017-3236626) 02 - Windows
Oracle Java SE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Oracle Java SE Smart Card IO Subcomponent Unauthorized Operation Vulnerability
Oracle Java SE is the United States Oracle Oracle company's set of standard version of the Java platform for the development and deployment of desktop, server, and embedded devices and real-time environments in the Java application. A security vulnerability exists in the Smart Card IO subcomponen...
CVE-2017-10274
Vulnerability in the Java SE component of Oracle Java SE subcomponent: Smart Card IO. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE...
KLA11122 Multiple vulnerabilities in Oracle Java SE, Java SE Embedded and JRockit
Multiple serious vulnerabilities have been found in Oracle Java SE. Malicious users can exploit these vulnerabilities to cause denial of service and bypass security restrictions. Below is a complete list of vulnerabilities: 1. An unspecified vulnerability in subcomponent Smart Card IO can be...
Apple iOS 10.2 (14C92) - Remote Code Execution
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1317c3 The exploit achieves R/W access to the host's physical memory. This exploit has been tested on the iPhone 7, iOS 10.2 14C92. To run the exploit against different devices or versions, the symbols must be adjusted. The attache...
CVE-2017-15268
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c...
CVE-2017-15268
CVE-2017-15268 affects QEMU up to version 2.10.0 and enables a remote attacker to cause a memory leak by triggering slow data-channel read operations in io/channel-websock.c (network attack surface). Connected advisories for affected vendors reference QEMU-related CVEs and list patches in Red Hat...
Ubuntu: Security Advisory (USN-3444-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3444-1)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3444-1 advisory. Jan H. Schnherr discovered that the Xen subsystem did not properly handle block IO merges correctly in some situations. An attacker in a guest vm could u...
USN-3444-1 linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
Jan H. Schönherr discovered that the Xen subsystem did not properly handle block IO merges correctly in some situations. An attacker in a guest vm could use this to cause a denial of service host crash or possibly gain administrative privileges in the host. CVE-2017-12134 Andrey Konovalov...
Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3622)
The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3622 advisory. - Bluetooth: Properly check L2CAP config option output buffer length Ben Seri Orabug: 26796428 CVE-2017-1000251 - xen: fix bio vec merging Roger Pa...
UBUNTU-CVE-2017-14318
An issue was discovered in Xen 4.5.x through 4.9.x. The function gnttabcacheflush handles GNTTABOPcacheflush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mappin...
CVE-2017-14153
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL...
360.io XSS vulnerability
Vulnerable URL: https://360.io/help/myaccount/!prettyPhoto/x,%3Csvg/onload=alert%27openbugbounty%27%3E/x Details: Description| Value ---|--- Patched:| No Latest check for patch:| 07.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 636457 VIP website status:| ...
CVE-2017-12840
A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to allocate sufficien...
CVE-2017-12134
The xenbiovecphysmergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability...
CVE-2017-12134
The xenbiovecphysmergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability...
Cross-site Scripting (XSS)
appserver-io/http is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitze user input, allowing a malicious user to inject and execute arbitrary webscript...
360.io XSS vulnerability
Vulnerable URL: https://360.io/!prettyPhoto/0,%3Ca%20onclick=%22alert%27OPENBUGBOUNTY%27;%22%3E/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 20.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 664584 VIP website status:| No Check...