CVE-2016-10138

An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute t...

CVE-2016-10139

The CVE-2016-10139 issue affects BLU R1 HD devices running Shanghai Adups software. The com.adups.fota.sysoper app declares android:sharedUserId as android.uid.system, allowing it to run as the privileged system user and grant additional permissions not listed in its manifest. This enables access...

CVE-2016-10136

An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the...

CVE-2016-10135

An issue was discovered on LG devices using the MTK chipset with L5.0/5.1, M6.0/6.0.1, and N7.0 software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any applicati...

CVE-2016-10139

An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.fota and com.adups.fota.sysoper. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of...

CVE-2016-10137

An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the...

Xen: Multiple vulnerabilities

Background Xen is a bare-metal hypervisor. Description Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details. Impact A local attacker could possibly execute arbitrary code with the privileges of the process, could gain privileges on t...

RPCBind: Denial of service

Background The RPCBind utility is a server that converts RPC program numbers into universal addresses. Description A use-after-free vulnerability was discovered in RPCBind’s svcdodestroy function when trying to free a corrupted xprt-xpnetid pointer. Impact A remote attacker could possibly cause a...

DEBIAN-CVE-2016-4578

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the 1 sndtimeruserccallback and 2 sndtimerusertinterrupt...

VLC: Multiple vulnerabilities

Background VLC is a cross-platform media player and streaming server. Description Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details. Impact Remote attackers could possibly execute arbitrary code or cause Denial of Service...

Cisco DPC2203 and EPC2203 Device Buffer Overflow Vulnerability

The Cisco DPC2203 and EPC2203 are both modem products from Cisco USA. A buffer overflow vulnerability exists in the web server in the Cisco DPC2203 and EPC2203 using firmware version r1customerimage. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP request to...

Cisco DPQ3925 Denial of Service Vulnerability

Cisco DPQ3925 is a wireless voice network management product of Cisco USA. web-based administration interface is one of the web-based management interface. A security vulnerability exists in the web-based administration interface in the Cisco DPQ3925 using firmware version r1. A remote attacker c...

GLSA-201602-01 : QEMU: Multiple vulnerabilities (Venom)

The remote host is affected by the vulnerability described in GLSA-201602-01 QEMU: Multiple vulnerabilities Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact : A remote attacker might cause a Denial of Service or gain...

dbaudio R1 2.14.4 Privilege Escalation

dbaudio R1 v2.14.4 DNS-SD Service Unquoted Service Path Privilege Escalation Vendor: d&b audiotechnik GmbH Product web page: http://www.dbaudio.com Affected version: R1 2.14.4 and DNS-SD 379.32.2 Summary: The R1 Remote control software succeeds the d&b ROPE C software. It is a software package...

dbaudio R1 v2.14.4 DNS-SD Service Unquoted Service Path Privilege Escalation

Summary The R1 Remote control software succeeds the d&b ROPE C software. It is a software package designed to operate d&b amplifiers D12, D6, E-PAC with Display remotely using the d&b Remote network based on CAN-Bus technology. Description The application suffers from an unquoted search path issu...

Netduma R1 1.03.4 / 1.03.5 Cross Site Request Forgery

Introduction Affected Product: Netduma R1 Router Affected Versions: 1.03.4 and 1.03.5 Link: http://www.netduma.com/firmware/R1-v-1-03-4.sig Vendor Website: https://netduma.com/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 11/19/2015 Disclosed to public: 12/29/2015 Credits:...

Android libstagefright - Integer Overflow Remote Code Execution

Exploit for Android platform in category remote exploits !/usr/bin/python2 import cherrypy import os import pwnlib.asm as asm import pwnlib.elf as elf import sys import struct with open'shellcode.bin', 'rb' as tmp: shellcode = tmp.read while lenshellcode % 4 != 0: shellcode += '\x00' heap groomin...

PT-2015-5507 · Ibm +2 · Ibm Sdk +3

Name of the Vulnerable Software and Affected Versions: IBM SDK, Java Technology Edition versions 8 before SR1 FP10 IBM SDK, Java Technology Edition 7 R1 before SR3 FP10 IBM SDK, Java Technology Edition 7 before SR9 FP10 IBM SDK, Java Technology Edition 6 R1 before SR8 FP7 IBM SDK, Java Technology...

The vulnerability of the Gentoo Linux operating system, which allows a malicious intruder to compromise the accessibility of protected information

The vulnerability of the kdegraphics-kfile-plugins package up to version 3.5.5-r1 in the Gentoo Linux operating system can lead to a violation of the accessibility of protected information. This vulnerability can be exploited remotely...

The vulnerability of the Gentoo Linux operating system, which allows a malicious intruder to compromise the accessibility of protected information

The vulnerability of the ksirc package up to version 3.5.5-r1 of the Gentoo Linux operating system can lead to a violation of the accessibility of protected information. This vulnerability can be exploited remotely...