CVE-2017-11169

Privilege Escalation on iBall iB-WRA300N3GT iB-WRA300N3GT1.1.1 devices allows remote authenticated users to obtain root privileges by leveraging a guest/user/normal account to submit a modified privilege parameter to /form2userconfig.cgi...

PT-2017-14517

Name of the Vulnerable Software and Affected Versions Datto Windows Agent versions 1.0.5.0 and earlier Description The issue allows unauthenticated remote command execution via a modified command. This can be achieved by combining a malformed primary whitelisted command with a secondary...

Security Update for Microsoft SharePoint Foundation 2013 (KB4011180) farm-deployment

A security vulnerability exists in Microsoft SharePoint Foundation 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft SharePoint Enterprise Server 2013 (KB4011068) farm-deployment

A security vulnerability exists in Microsoft SharePoint Enterprise Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Code injection

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...

Security Update for Microsoft SharePoint Enterprise Server 2013 (KB4011113)

A security vulnerability exists in Microsoft SharePoint Enterprise Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

CVE-2016-0713

Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting XSS attacks via vectors related to modified requests...

PT-2017-7644

Name of the Vulnerable Software and Affected Versions Cloud Foundry cf-release versions v141 through v228 Description The issue allows man-in-the-middle attackers to conduct cross-site scripting XSS attacks via vectors related to modified requests. Recommendations For Cloud Foundry cf-release...

Revamped Nukebot Malware Changes Targets, Adds Functions

A revamped version of the Nukebot banking trojan dubbed Jimmy Nukebot has shifted focus from stealing bankcard data and now acts as a conduit for quietly downloading malicious payloads for web-injects, cryptocurrency mining, and taking screenshots of targeted systems. The code is a modification o...

The vulnerability of the microprogramming software of the DIR-615 Wireless N 300 router allows a hacker to bypass the authentication process.

The vulnerability of the DIR-615 Wireless N 300 router’s microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process by using a modified POST request to login.cgi...

CVE-2017-7781/CVE-2017-10176: Issue with elliptic curve addition in mixed Jacobian-affine coordinates in Firefox/Java

tl;dr Firefox and Java suffered from a moderate vulnerability affecting the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result POINTATINFINITY when it should not. Introduction Few months ago I was working on a vulnerability affecting th...

CVE-2017-9457

Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...

PT-2017-18933

Name of the Vulnerable Software and Affected Versions Intense PC Phoenix SecureCore UEFI firmware affected versions not specified Description The issue concerns the lack of capsule signature validation in the UEFI firmware before upgrading the system firmware. This absence of validation enables a...

Fedora 26 : php-pear-PHP-CodeSniffer (2017-b85d51cc47)

Version 3.0.1 - This release contains a fix for a security advisory related to the improper handling of a shell command - A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option - All version 3 users are encouraged to upgrade to...

Security Update for Microsoft SharePoint Enterprise Server 2013 (KB3213559)

A security vulnerability exists in Microsoft SharePoint Enterprise Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft SharePoint Enterprise Server 2016 (KB3213544) farm-deployment

A security vulnerability exists in Microsoft SharePoint Enterprise Server 2016 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft Excel 2016 (KB3203477) 64-Bit Edition

A security vulnerability exists in Microsoft Excel 2016 64-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Authentication flaw

The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change...

CVE-2016-4383

The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change...

CVE-2016-4383

The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change...