CVE-2017-16819

A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst aka First Name field for the employee details page /employee.html that is then reflected in multiple pages where...

Microsoft ASP.NET Core Elevation of Privilege Vulnerability (CNVD-2017-37114)

Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web One applications, IoT applications, and mobile backends. A privilege extraction vulnerability exists in Microsoft ASP.NET Core version 2.0. A remote...

Patch Tuesday: Microsoft Releases Update to Fix 53 Vulnerabilities

It's Patch Tuesday—time to update your Windows devices. Microsoft has released a large batch of security updates as part of its November Patch Tuesday in order to fix a total of 53 new security vulnerabilities in various Windows products, 19 of which rated as critical, 31 important and 3 moderate...

November Patch Tuesday: 53 Vulnerabilities and a Massive Adobe Update

This November Patch Tuesday is moderate in volume and severity. Microsoft released patches to address 53 unique vulnerabilities, with 25 focused on Remote Code Execution fixes. Windows OS receives 14 patches, while the lion's share is focused on Browsers, Microsoft Office, and Adobe. According to...

PowerShell Penetration Testing Framework: Nishang

Nishang is an open source framework and collection of powerful PowerShell scripts and payloads that you can use during penetration testing audit, post exploitation phase or other stages of offensive security auditing. Nishang is useful during various phases of a security auditing process and has...

The vulnerability of Xen hypervisors relates to deficiencies in access control, allowing attackers to trigger service failures or increase their privileges.

The vulnerability of Xen hypervisors is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating locally within a user account of the x86 guest operating system in hardware virtualization mode, to trigger a hypervisor failure or increase their...

Service Assistant GUI Elevation of Privilege Vulnerability in Multiple IBM Products

The IBM Storwize V7000, Storwize V5000, and FlashSystem V9000 are products of IBM Corporation in the U.S.A. The IBM Storwize V7000 and Storwize V5000 are virtualized storage systems.The FlashSystem V9000 is an all-flash enterprise storage The Service Assistant GUI is one of the graphical user...

VMware AirWatch Launcher for Android UI Elevation of Privilege Vulnerability

VMware AirWatch is a suite of enterprise mobility management solutions from VMware, Inc. and VMware AirWatch Launcher for Android is one of the launchers based on the Android platform. A privilege extraction vulnerability exists in versions of VMware AirWatch Launcher for Android prior to 3.2.2. ...

TG Soft Vir.IT eXplorer Anti-Virus Local Elevation of Privilege Vulnerability

TG Soft Vir.IT eXplorer Anti-Virus is a malware protection suite from TG Software Italy. A security vulnerability exists in the driver file VIAGLT64.SYS in TG Vir.IT eXplorer Anti-Virus, which originates from the program's failure to validate the input value of IOCtl 0x8273007C. An attacker can...

CVE-2017-5099

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page...

CVE-2017-5099

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page...

Input validation

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page...

CVE-2017-5099

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page...

CVE-2017-5099

Google Chrome for Mac PPAPI Plugins were vulnerable due to insufficient validation of untrusted input, enabling privilege elevation via a crafted HTML page. Affected component: PPAPI Plugins in Chrome on macOS; root cause: input validation failure; impact: remote privilege elevation with user int...

CVE-2017-5099

Removed by vendor...

CVE-2017-5099

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page...

Elastic Kibana X-Pack 'CVE-2017-8448' Privilege Elevation Vulnerability - Linux

Elastic Kibana with X-Pack is prone to a privilege elevation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Kibana X-Pack 'CVE-2017-8448' Privilege Elevation Vulnerability - Windows

Elastic Kibana with X-Pack is prone to a privilege elevation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CPUID CPU-Z Arbitrary Read/Write Privilege Elevation Vulnerability

CPUID CPU-Z is a free software package for collecting information about system devices. A security vulnerability exists in versions of CPUID CPU-Z prior to 1.43, which originates from a program that can send ioctl 0x9C402430 calls to the kernel mode driver to exploit the vulnerability by writing ...

Progea Movicon SCADA/HMI Elevation of Privilege Vulnerability

Movicon is Scada/HMI industrial monitoring software developed by the Italian automation software provider PROGEA. An elevation of privilege vulnerability exists in Progea Movicon SCADA/HMI that allows an authorized local user to insert arbitrary code into an unreferenced service path and escalate...