DEBIAN-CVE-2018-14338

samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms other than Apple platforms where glibc is not used, possibly leading to a buffer overflow...

Facebook Faces £500,000 Fine in U.K. Over Cambridge Analytica Leak

Facebook has been fined £500,000 $664,000 in the U.K. after the country's data protection watchdog concluded that its data-sharing scandal broke the law, making it as the social network's first fine over the Cambridge Analytica scandal. Yes, £500,000—that's the maximum fine allowed by the UK's Da...

PT-2018-3305 · Neomutt +4 · Neomutt +4

Name of the Vulnerable Software and Affected Versions: NeoMutt versions prior to 2018-07-16 Description: The issue is related to a stack-based buffer overflow in the nntp add group function in the newsrc.c file of the NeoMutt email client. This overflow is caused by incorrect usage of the sscanf...

Bug Bounty Programs Turn Attention to Data Abuse

More companies – particularly social media firms – may follow Facebook’s footsteps in turning to bug bounty programs to scout out any data privacy abuse on their platforms, experts say. On the heels of Facebook’s Cambridge-Analytica scandal in March, the social media giant launched a “Data Abuse...

Security Bulletin: IBM QRadar SIEM contains unnecessary privilege usage. (CVE-2016-2876)

Summary Multiple processes run by IBM QRadar SIEM use higher than necessary privileges, which can be abused due to other shell command injection vulnerabilities. Vulnerability Details CVE-ID: CVE-2016-2876 Description: IBM QRadar could allow an authenticated user to inject operating system comman...

Bypass Glitch Allows Malware to Masquerade as Legit Apple Files

Masquerading as an official Apple system file sounds like a wonderful way for malware to worm its way onto Macs – and a recently discovered code-signing bypass flaw allows bad code to do just that. The way some developers have implemented Apple’s official code-signing API can be exploited by...

CVE-2017-3201

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an...

1834: The First Cyberattack

Tom Standage has a great story of the first cyberattack against a telegraph network. The Blanc brothers traded government bonds at the exchange in the city of Bordeaux, where information about market movements took several days to arrive from Paris by mail coach. Accordingly, traders who could ge...

Buffer overflow

Espruino before 1.99 allows attackers to cause a denial of service application crash and a potential Escalation of Privileges with a user crafted input file via a Buffer Overflow during syntax parsing, because strncat is misused...

CVE-2018-11595

Espruino before 1.99 allows attackers to cause a denial of service application crash and a potential Escalation of Privileges with a user crafted input file via a Buffer Overflow during syntax parsing, because strncat is misused...

CVE-2018-11593

Espruino before 1.99 allows attackers to cause a denial of service application crash and potential Information Disclosure with a user crafted input file via a Buffer Overflow during syntax parsing because strncpy is misused in jslex.c...

CVE-2018-11595

Espruino before 1.99 allows attackers to cause a denial of service application crash and a potential Escalation of Privileges with a user crafted input file via a Buffer Overflow during syntax parsing, because strncat is misused...

Denial Of Service (DoS)

libtiff.so is vulnerable to denial of service DoS attacks. The vulnerability exists due to the improper use of assert in readSeparateTilesIntoBuffer of tiffcp.c where a condition that triggers the assertion failure occurs, causing the denial of service DoS attack...

CVE-2018-11232

The etmsetupaux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service panic because a parameter is incorrectly used as a local variable...

Code injection

The etmsetupaux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service panic because a parameter is incorrectly used as a local variable...

UBUNTU-CVE-2018-11232

The etmsetupaux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service panic because a parameter is incorrectly used as a local variable...

CVE-2018-11232

The vulnerability CVE-2018-11232 affects the Linux kernel, specifically the etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c, and exists in versions prior to 4.10.2. The root cause is that a parameter is incorrectly used as a local variable, which can lead to a denial of...

CVE-2018-11232

The etmsetupaux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service panic because a parameter is incorrectly used as a local variable...

TIBCO DataSynapse GridServer Manager GridServer Broker, GridServer Driver and GridServer Engine Component Server Encryption Misuse Vulnerability

TIBCO DataSynapse GridServer Manager is a management system for managing GridServer environments from TIBCO Software, Inc. GridServer Broker is a workload management component; GridServer Driver is a driver component; GridServer Broker is a workload management component; GridServer Driver is a...

CVE-2018-11210

TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml2 developers have determined that the reported overflow is due to improper use of the library and not a vulnerability in tinyxml2...