CVE-2018-11019

CVV-2018-11019 affects the kernel component in Amazon Kindle Fire HD(3rd) running Fire OS 4.5.5.3. The issue is in kernel/omap/drivers/misc/gcx/gcioctl/gcif.c and allows an attacker to inject a crafted argument via an ioctl on device /dev/gcioctl using command 3221773726, causing a kernel crash. ...

GLSA-201807-04 : cURL: Heap-based buffer overflow

The remote host is affected by the vulnerability described in GLSA-201807-04 cURL: Heap-based buffer overflow A heap-based buffer overflow was discovered in cURLs Curlsmtpescapeeob function. Impact : An attacker could cause a Denial of Service condition or execute arbitrary code via SMTP...

GNU Wget: Cookie injection

Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description A vulnerability was discovered in GNU Wget’s respnew function which does not validate \r\n sequences in continuation lines. Impact A remote attacker...

OracleVM 3.4 : xen (OVMSA-2018-0221)

The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8 - BUILDINFO: xen commit=5ee0a217664a1fde547afa506e92e4998ed26699 - BUILDINFO: QEMU upstream...

GLSA-201805-04 : rsync: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-201805-04 rsync: Arbitrary command execution A vulnerability was discovered in rsyncs parsearguments function in options.c. Impact : Remote attackers could possibly execute arbitrary commands with the privilege of the process...

rsync: Arbitrary command execution

Background File transfer program to keep remote files into sync. Description A vulnerability was discovered in rsync’s parsearguments function in options.c. Impact Remote attackers could possibly execute arbitrary commands with the privilege of the process. Workaround There is no known workaround...

Google Android has an unspecified vulnerability (CNVD-2018-10115)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, and Qualcomm MDM9615 and other central processing unit CPU products from Qualcomm. A security vulnerability exists in the Qualcomm closed-source component in Android 2018-04-05 an...

GLSA-201804-17 : Quagga: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201804-17 Quagga: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Quagga. Please review the CVE identifiers referenced below for details. Impact : A remote attacker, by sending specially crafted packets,...

CVE-2014-10057

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 435, SD 617, SD 625, and SnapdragonHighMed2016, binary Calibration files under data/misc/audio have 777...

misc-store.com XSS vulnerability

Open Bug Bounty ID: OBB-600850 Description| Value ---|--- Affected Website:| misc-store.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Solaris 10 (x86) : 119720-01

SunOS 5.10x86: patch kernel/misc/kmdbmod. Date this patch was last updated by Sun : Aug/18/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Solaris 10 (sparc) : 119059-72

X11 6.6.2: Xsun patch. Date this patch was last updated by Sun : Mar/09/17 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

2017 in Snort Signatures.

This post was written by Martin Lee and Vanja Svajcer. 2017 was an eventful year for cyber security with high profile vulnerabilities that allowed self-replicating worm attacks such as WannaCry and BadRabbit to impact organizations throughout the world. In 2017, Talos researchers discovered many...

GLSA-201801-13 : TigerVNC: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201801-13 TigerVNC: Multiple vulnerabilities Multiple vulnerabilities have been discovered in TigerVNC. Please review the referenced CVE Identifiers for details. Impact : An attacker could execute arbitrary code or cause a Denial ...

TigerVNC: Multiple vulnerabilities

Background TigerVNC is a high-performance VNC server/client. Description Multiple vulnerabilities have been discovered in TigerVNC. Please review the referenced CVE Identifiers for details. Impact An attacker could execute arbitrary code or cause a Denial of Service condition. Workaround There is...

OpenSSH: Permission issue

Background OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support. Description The processopen function in sftp-server.c in OpenSSH did not properly prevent write operations in readonly mode. Impact A remote attacker could cause the creation of zero-length...

FS IMDB Clone SQL Injection Vulnerability

FS IMDB Clone is a set of PHP-based scripts for online movie ticket booking websites. A SQL injection vulnerability exists in FS IMDB Clone version 1.0. The vulnerability can be exploited to inject SQL by sending the 'f' parameter to the movie.php file, the 's' parameter to the tvshow.php file, o...

CVE-2017-17588

FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or showmiscvideo.php id parameter...

VDE: Privilege escalation

Background VDE is an ethernet compliant virtual network that can be spawned over a set of physical computer over the Internet. Description It was discovered that Gentoo’s default VDE installation suffered from a privilege escalation vulnerability in the init script. This script calls an unsafe...

Out-of-bounds

The imspcugetcdcuniondesc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service imspcuparsecdcdata out-of-bounds read and system crash or possibly have unspecified other impact via a crafted USB device...