PT-2018-3735

Name of the Vulnerable Software and Affected Versions X Window System affected versions not specified ALT Linux affected versions not specified ROSA Linux affected versions not specified МСВСфера affected versions not specified Description The issue is related to the lack of validation when one...

Microsoft Windows gdiplus bParseWin32Metafile Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Pro DC HTML2PDF HTML Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

Adobe Acrobat Pro DC HTML2PDF HTML Parsing Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Reader DC Onix Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Pro DC HTML2PDF HTML Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

Adobe Reader DC Onix32 Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2018-3416

Name of the Vulnerable Software and Affected Versions: SAP Mobile Secure for Android versions prior to 6.60.19942.0 SP28 1711 Description: The issue is related to the lack of protection for service data in SAP Mobile Secure for Android. Under certain conditions, this can allow an attacker to acce...

PT-2018-15184

Name of the Vulnerable Software and Affected Versions KT MC01507L Z-Wave S0 devices affected versions not specified Description The issue arises due to the lack of HPKP implementation, allowing an attacker on the same network as the target HUB to intercept cleartext communication between the Serv...

CVE-2018-11905: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Possible buffer overflow in WLAN function due to lack of input validation in values received from firmware...

PT-2018-10899

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue is related to a possible buffer overflow in the WLAN function due to a lack of...

NRCC Email Hack Highlights Lack of Visibility & Proactive Threat Hunting at Political Organizations

Earlier this week, Politico reported that the National Republican Congressional Committee NRCC suffered a major attack prior to the 2018 U.S. midterm elections, with thousands of sensitive emails from four senior aides exposed to an outside intruder. While the impact of this breach is still...

CVE-2018-6101: Improper Input Validation

A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server...

Cross-site Scripting (XSS)

php-proxy-app is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on the URL field in index.php, allowing reflected XSS attacks...

LoginPress <= 1.1.15 - Authenticated Blind SQL Injection

Blind time-based SQL injection, combined with lack of permission check resulted in an unauthorised attack which can be performed by any user on the site including subscriber profiles. 1. Lack of permission check in settings import Similar to our recent analysis, this vulnerability was also caused...

CVE-2018-11264: Improper Restriction of Operations within the Bounds of a Memory Buffer

Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 45...

PT-2018-14258

Name of the Vulnerable Software and Affected Versions Philips iSite and IntelliSpace PACS versions all iSite PACS versions all IntelliSpace PACS versions all Description The issue concerns default credentials and lack of authentication within third-party software, potentially allowing an attacker...

Cross-site Scripting (XSS)

catalina is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on the message argument sent to the HttpServletResponse.sendError method, allowing XSS attacks...

Apple macOS usymptomsd Out-Of-Bounds Access Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the usymptomsd...

Advantech WebAccess Client bwswfcfg Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Client. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwswfcfg.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs...