CVE-2017-8141

The Touch Panel TP driver in P10 Plus smart phones with software versions earlier than VKY-AL00C00B153 has a memory double free vulnerability. An attacker with the root privilege of the Android system tricks a user into installing a malicious application, and the application can start multiple...

CVE-2017-8150

The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, the versions before Vicky-L29AC605B162 have an arbitrary memory write vulnerability due to the lack of parameter validation. An attacker wi...

CVE-2017-8172

The CVE-2017-8172 issue affects Huawei Vicky/Victoria series (P10 Plus and P10) with earlier VKY-AL00C00B157 and VTR-AL00C00B157 revisions. The root cause is in the isub service where crafted input parameters to a specific interface enable an out-of-bounds array access, triggering a device restar...

CVE-2017-8150

The CVE-2017-8150 entry affects Huawei P10 and P10 Plus bootloaders. The vulnerability is an arbitrary memory write caused by lack of parameter validation in boot loaders for versions prior to Victoria-L09AC605B162, Victoria-L29AC605B162, and Vicky-L29AC605B162. An attacker with root access on An...

CVE-2017-8149

CVE-2017-8149 affects Huawei P10 and P10 Plus boot loaders, where lack of parameter validation causes out-of-bounds memory access. An attacker with root privileges on Android could lure a user to install a malicious app, enabling the app to modify data and trigger a buffer overflow on the next re...

CVE-2017-2711

CVE-2017-2711 affects Huawei P9 Plus smartphones running software older than VIE-AL10C00B352. The issue is an input validation vulnerability in the touchscreen driver that can be triggered by a malicious application installed by the user, which sends crafted parameters to crash the system (or reb...

CVE-2017-8140

The soundtrigger driver in P9 Plus smart phones with software versions earlier than VIE-AL10BC00B353 has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which cou...

CVE-2017-2734

Huawei P9 Plus smartphones running software before VIE-AL10BC00B386 are affected by CVE-2017-2734, a DoS via a malicious app that sends crafted parameters to a specific interface, triggering excessive memory allocations and device crash. Severity is noted as high in CVSS2/3 metrics (local vs netw...

CVE-2017-8145

CVE-2017-8145 affects Huawei P10 and P10 Plus call module. The DoS condition exists in software versions before specific builds (VTR-AL00C00B167, VTR-TL00C01B167, VKY-AL00C00B167, VKY-TL00C01B167). An attacker can trick a user into installing a malicious app that sends crafted parameters to the c...

CVE-2017-8146

CVE-2017-8146 affects Huawei P10/P10 Plus call module. The vulnerability allows a crafted malicious app to send specific parameters to the call module, causing denial of service and crashing the call and data communication processes. Affected software versions include prior builds before VTR-AL00...

CVE-2017-2724

Bastet in P10 Plus and P10 smart phones with software earlier than VKY-AL00C00B123 versions, earlier than VTR-AL00C00B123 versions have a buffer overflow vulnerability. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify...

CVE-2017-2725

Bastet in P10 Plus and P10 smart phones with software earlier than VKY-AL00C00B123 versions, earlier than VTR-AL00C00B123 versions have a buffer overflow vulnerability. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify...

CVE-2017-2726

CVE-2017-2726 affects Huawei Bastet on P10 Plus and P10, prior to VKY-AL00C00B123/VTR-AL00C00B123 builds. Description and CNVD/Huawei advisories indicate a buffer overflow in Bastet caused by lack of parameter checking, exploitable when root Android is present and a user installs a malicious app....

WordPress WP Support Plus Responsive Ticket System plugin <=8.0.7 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability found in WordPress WP Support Plus Responsive Ticket System plugin versions =8.0.7. Solution Update the WordPress WP Support Plus Responsive Ticket System plugin to the latest available version at least version 8.0.8...

WP Support Plus Responsive Ticket System < 8.0.8 - Remote Code Execution (RCE)

WP Support Plus Responsive Ticket System = 8.0.7 allows anyone to upload PHP files with extensions like ".phtml", ".php4", ".php5", and so on, all of which are run as if their extension was ".php" on most hosting platforms. This is because "includes/admin/attachment/uploadAttachment.php" contains...

ManageEngine ServiceDesk Plus Multiple Vulnerabilities (Nov 2017) - Active Check

ManageEngine ServiceDesk Plus is prone to multiple arbitrary file download vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

WebKit and WebKitGTK+ Remote Code Execution Vulnerability

WebKit is KDE, Apple Apple, Google Google and other companies jointly developed a set of open source Web browser engine , currently used by Apple Safari and Google Chrome and other browsers.WebKitGTK + is a multi-function port for the WebKit rendering engine . A security vulnerability exists in t...

WebKit and WebKitGTK+ Denial of Service Vulnerabilities

WebKit is KDE, Apple Apple, Google Google and other companies jointly developed a set of open source Web browser engine , currently used by Apple Safari and Google Chrome and other browsers.WebKitGTK + is a multi-function port for the WebKit rendering engine . A security vulnerability exists in t...

notepad-plus-plus.org XSS vulnerability

Open Bug Bounty ID: OBB-385810 Description| Value ---|--- Affected Website:| notepad-plus-plus.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

Oracle Hyperion Unspecified Vulnerability in Oracle Hyperion BI+ Component

Oracle Hyperion is a suite of financial modeling applications from Oracle, which provides financial closure, report creation, etc. Oracle Hyperion BI+ is one of the business intelligence platform components that provides management reporting and analysis on any data source. An unspecified...