PT-2018-5775

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.13.12 Description: A flaw was found in the hugetlb mcopy atomic pte function in mm/hugetlb.c, which could cause a denial of service due to a lack of size check. Recommendations: For versions prior to 4.13.12,...

Why emerging APAC markets are prime targets for the malware of the future

In many ways, Asia has led the way in technological development. Robotics, video games, dizzyingly fast Internet speeds. But when it comes to cybersecurity, several APAC countries, especially those in emerging markets, are severely lacking. And while, according to the 2017 State of Malware Report...

Integer overflow

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

Design/Logic Flaw

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-10944

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

PT-2017-3369

Name of the Vulnerable Software and Affected Versions Progress Software OpenEdge versions 10.2x through 11.x Description The issue is related to an insecure default configuration that lacks proper access control, allowing unauthenticated remote attackers to load and execute malicious Java classes...

CVE-2017-5065

Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially confuse a user into making an incorrect security decision via a crafted HTML page...

CVE-2016-10517

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol but commonly occur when an attack triggers an HTTP request to the Redis TCP port...

Input validation

A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from the affected software, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input and validation checks in t...

CVE-2014-7813

Red Hat CloudForms 3 Management Engine CFME allows remote authenticated users to cause a denial of service resource consumption via vectors involving calls to the .tosym rails function and lack of garbage collection of inserted symbols...

PT-2017-13975

Name of the Vulnerable Software and Affected Versions SAP Hostcontrol affected versions not specified Description The issue concerns the lack of authentication requirement for the SOAP SAPControl endpoint in SAP Hostcontrol. Recommendations At the moment, there is no information about a newer...

PT-2017-11417

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 17.1R1 Description The issue is related to a lack of authentication and authorization of cluster messages, which could allow a man-in-the-middle attacker to intercept, inject, or disrupt cluster...

Microsoft Windows Font Embedding Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

(0Day) Microsoft Windows WAV File Uninitialized Pointer Denial of Service Vulnerability

This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...

CVE-2017-1000076

CVE-2017-1000076 entry is rejected/not used; withdrawn by the CNA due to lack of provenance.

Hewlett Packard Enterprise Intelligent Management Center WebDMServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WebDMServlet, which listens on TCP ports...

FreeBSD : dnsmasq -- multiple vulnerabilities (b77b5646-a778-11e7-ac58-b499baebfeaf)

Google Project Zero reports : - CVE-2017-14491: Heap based overflow 2 bytes. Before 2.76 and this commit overflow was unrestricted. - CVE-2017-14492: Heap based overflow. - CVE-2017-14493: Stack Based overflow. - CVE-2017-14494: Information Leak - CVE-2017-14495: Lack of free - CVE-2017-14496:...

dnsmasq -- multiple vulnerabilities

Google Project Zero reports: CVE-2017-14491: Heap based overflow 2 bytes. Before 2.76 and this commit overflow was unrestricted. CVE-2017-14492: Heap based overflow. CVE-2017-14493: Stack Based overflow. CVE-2017-14494: Information Leak CVE-2017-14495: Lack of free CVE-2017-14496: Invalid boundar...

CVE-2017-14977

The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack...

PT-2017-13690

Name of the Vulnerable Software and Affected Versions Philips Hue Bridge BSB002 version 1707040932 Description The issue is related to a lack of transport encryption in the public API, allowing remote attackers to read API keys by sniffing HTTP traffic on the local intranet network. This can lead...