Citrix Hypervisor Open Source Licensing and Attribution

The Citrix Hypervisor product is a compilation of software packages. Each package is governed by its own license. The complete licensing terms applicable to a given package can be found in the source RPM of the package, unless the package is covered by a proprietary license which does not permit...

Internet Bug Bounty: [bower] Arbitrary File Write through improper validation of symlinks while package extraction

Hi, I want to submit my report https://hackerone.com/reports/473811 for the Internet Bug Bounty. Snyk's writeup: https://snyk.io/blog/severe-security-vulnerability-in-bowers-zip-archive-extraction My assessment on why this report might be eligible: To qualify, vulnerabilities must meet the...

CVE-2017-14804

The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots...

NVIDIA Windows GPU Display Driver 375.x < 376.67 / 378.x < 378.52 Multiple Vulnerabilities

The version of the NVIDIA GPU display driver installed on the remote Windows host is 375.x prior to 376.67 or 378.x prior to 378.52. It is, therefore, affected by multiple vulnerabilities : - Multiple overflow conditions exist in the kernel mode layer handler nvlddmkm.sys for DxgkDdiEscape due to...

CVE-2017-0317

CVE-2017-0317 concerns the NVIDIA GPU and GeForce Experience installer on Windows. The vulnerability arises from improper permissions on the package extraction path, which could allow a non-privileged user to tamper with extracted files and potentially escalate to code execution. The connected Ne...