PT-2017-3103

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 10 Gold, 1511, 1607, and 1703 Microsoft Windows Server 2016 Description The issue is related to errors that occur when loading DLL files, allowing a remote attacker to execute arbitrary code using specially crafted D...

PT-2017-12441

Name of the Vulnerable Software and Affected Versions Cisco Meeting App for Windows affected versions not specified Description The issue is related to incomplete input validation of the path name for DLL files before they are loaded, which could allow an authenticated, local attacker to run an...

CVE-2017-12266: Uncontrolled Search Path Element

A vulnerability in the routine that loads DLL files in Cisco Meeting App for Windows could allow an authenticated, local attacker to run an executable file with privileges equivalent to those of Cisco Meeting App. The vulnerability is due to incomplete input validation of the path name for DLL...

PT-2017-13187

Name of the Vulnerable Software and Affected Versions i-SENS SmartLog Diabetes Management Software versions 2.4.0 and prior Description An Uncontrolled Search Path or Element issue was discovered, which could be exploited by placing a specially crafted DLL file in the search path, allowing an...

CVE-2017-12620

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache...

CVE-2017-12620

CVE-2017-12620 describes an XML External Entity (XXE) vulnerability in Apache OpenNLP when loading models or dictionaries that contain XML from untrusted sources. The connected documents identify the affected OpenNLP versions: 1.5.0–1.5.3, 1.6.0, and 1.7.0–1.7.2, 1.8.0–1.8.1. The XXE issue is the...

PT-2017-12605

Name of the Vulnerable Software and Affected Versions Apache OpenNLP versions 1.5.0 through 1.5.3 Apache OpenNLP version 1.6.0 Apache OpenNLP versions 1.7.0 through 1.7.2 Apache OpenNLP versions 1.8.0 through 1.8.1 Description The issue allows for an XXE attack when loading models or dictionaries...

CVE-2017-13676

Norton Remove & Reinstall can be susceptible to a DLL preloading vulnerability. These types of issues occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a...

Unbreakable Enterprise kernel security update

2.6.39-400.297.9 - fs/binfmtelf.c: fix bug in loading of PIE binaries Michael Davidson Orabug: 26870958 CVE-2017-1000253...

DreamTV - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application DreamTV published at the 'play' market has multiple vulnerabilities...

ansible-vault Yaml Load Code Execution Vulnerability

Summary An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability. Tested Versions ansible-vault...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

Apple macOS High Sierra Mail Information Disclosure Vulnerability

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.Mail component is one of the email components. A security vulnerability exists in the Mail component of Apple macOS High Sierra versions prior to 10.13, which stems from the program failing to disable t...

CVE-2017-14685

Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xpsloadlinksinglyphs in...

CVE-2017-14685

Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xpsloadlinksinglyphs in...

Cisco FindIT Network Discovery Utility Code Execution Vulnerability

Cisco FindIT Network Discovery Utility is a network device manager from Cisco USA. The product provides management functions for Cisco network devices. A security vulnerability exists in the Cisco FindIT Network Discovery Utility. A local attacker can exploit this vulnerability by placing an...

Microsoft Edge 38.14393.1066.0 - Memory Corruption with Partial Page Loading

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1309 There is a security issue in Microsoft Edge related to how HTML documents are loaded. If Edge displays a HTML document from a slow HTTP server, it is possible that a part of the document is going to be rendered before the serv...

Secure App's access on Android devices Hung with the Screen "please wait"

End user accesses Secure App's on Android device which flips to SecureHub forauthentication and will get stuck on the screen 'Please wait' and circle keep on spinning endlessly. Screenshot Below for reference:...

GDK-PixBuf: Multiple vulnerabilities

Background GDK-PixBuf is an image loading library for GTK+. Description Multiple vulnerabilities have been discovered in GDK-PixBuf. Please review the referenced CVE identifiers for details. Impact A remote attacker, by sending a specially crafted TIFF, JPEG, or URL, could execute arbitrary code...