User Agent String Switcher Service - XSS Vulnerabilities

Document Title: =============== User Agent String Switcher Service - XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2189 Release Date: ============= 2019-08-13 Vulnerability Laboratory ID VL-ID: ====================================...

DEF CON 2019: New Class of SQLite Exploits Open Door to iPhone Hack

LAS VEGAS – Researchers at Check Point have identified a new class of vulnerabilities targeting SQLite, outside the context of a browser for the first time. The new attack techniques exploit memory-corruption issues in the SQLite engine itself — leading to a host of new hacks, including code...

HPSBHF03626 rev. 1 - Intel Turbo Boost Max Technology 3.0 Advisory

Potential Security Impact Escalation of Privilege Source: HP, HP Product Security Response Team PSRT Reported By: Intel VULNERABILITY SUMMARY HP has been notified of a potential security vulnerability with the Intel Turbo Boost Max Technology 3.0 Driver, which may allow escalation of privilege...

Meet AttackSurfaceMapper; new automated penetration testing tool

By Sudais AttackSurfaceMapper penetration testing tool has been developed in Python 3.x, is compatible with all major operating systems. This is a post from HackRead.com Read the original post: Meet AttackSurfaceMapper; new automated penetration testing tool...

Facebook Plans on Backdooring WhatsApp

This article points out that Facebook's planned content moderation scheme will result in an encryption backdoor into WhatsApp: In Facebook's vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These...

The vulnerability of the Windows GDI component in Windows operating systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the Windows GDI component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the DirectWrite programming interface in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the DirectWrite application programming interface in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

[SECURITY] Fedora 30 Update: qemu-3.1.0-9.fc30

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

Lynis 2.7.5 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

The vulnerability of the Windows Audio service on Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Windows Audio service on Windows operating systems is related to privilege management errors. Exploiting this vulnerability can allow an attacker to enhance their privileges by using a specially created program...

The vulnerability of the Jet Database Engine database management system in Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Jet Database Engine database management system for Windows operating systems relates to operations that go beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Exploit for Use After Free in Microsoft

CVE-2019-0708-PoC-Hitting-Path Really Really Bad, don't judg...

[SECURITY] Fedora 30 Update: qemu-3.1.0-8.fc30

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

Microsoft Releases Security Updates to Address Remote Code Execution Vulnerability

Microsoft has released security updates to address a remote code execution vulnerability in the following in-support and out-of-support operating systems: In-support systems: Windows 7, Windows Server 2008 R2, and Windows Server 2008 Out-of-support systems: Windows 2003 and Windows XP A remote...

Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities

Executive Summary On May 14, 2019, Intel published information about a new subclass of speculative execution side channel vulnerabilities known as Microarchitectural Data Sampling. An attacker who successfully exploited these vulnerabilities may be able to read privileged data across trust...

The vulnerability of the Win32k component in Windows operating systems, which allows attackers to increase their privileges

The vulnerability of the Win32k component in Windows operating systems exists due to errors in memory object handling. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

Command injection

An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 formerly known as Cisco Workload Automation or CWA. The Enterprise Scheduler for AIX allows local users to gain privileges via Command Injection in crafted Tidal Job Buffers TJB parameters. NOTE: this vulnerability...

CVE-2019-9801

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry...

CVE-2019-9794

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the...

CVE-2019-9801

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry...