34 matches found
New Sturnus Android Trojan Quietly Captures Encrypted Chats and Hijacks Devices
Cybersecurity researchers have disclosed details of a new Android banking trojan called Sturnus that enables credential theft and full device takeover to conduct financial fraud. "A key differentiator is its ability to bypass encrypted messaging," ThreatFabric said in a report shared with The...
EUVD-2010-4629
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2017-18635
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages...
CVE-2021-41380: Improper Input Validation
RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service application crash via crafted RFB protocol data. NOTE: It is asserted that this issue requires social engineering a user into connecting to a fake VNC Server. The VNC Viewer application they are using will then hang,...
Updated novnc package fixes a security vulnerability
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name. CVE-2017-18635...
Ubuntu 16.04 LTS : noVNC vulnerability (USN-4522-1)
The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4522-1 advisory. It was discovered that noVNC did not properly manage certain messages, resulting in the remote VNC server injecting arbitrary HTML into the noVNC web page. An...
Heap overflow
Multiple heap-based buffer overflows in the ZRLEDECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service vncviewer crash and possibly execute arbitrary code via vectors related to screen image rendering...
CVE-2014-0011
Multiple heap-based buffer overflows in the ZRLEDECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service vncviewer crash and possibly execute arbitrary code via vectors related to screen image rendering...
CVE-2010-4664
In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privileges by initiating a remote VNC session...
Design/Logic Flaw
In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privileges by initiating a remote VNC session...
CVE-2010-4664
In ConsoleKit before 0.4.2, a policy restriction bypass allows an authenticated system user to escalate privileges by initiating a remote VNC session. Affected components: ConsoleKit (pre-0.4.2). Root cause: unintended security policy bypass. Impact: privilege escalation with remote VNC, cross-us...
CVE-2010-4664: Improper Privilege Management
In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privileges by initiating a remote VNC session...
PT-2019-6594
Name of the Vulnerable Software and Affected Versions ConsoleKit versions prior to 0.4.2 Description A security policy restriction bypass was found, allowing an authenticated system user to escalate their privileges by initiating a remote VNC session. Recommendations For versions prior to 0.4.2,...
CVE-2017-18635
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name...
CVE-2017-18635
CVE-2017-18635 describes an XSS in noVNC before 0.6.2 where a remote VNC server can inject arbitrary HTML into the noVNC page via status field messages (e.g., server name). Connected advisories confirm affected packages across multiple distros (Debian, Ubuntu, Mageia, Red Hat-related advisories) ...
Denial Of Service (DoS)
libvncserver is vulnerable to denial of service DoS attacks. The vulnerability exists as an integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service crash and possibly execute arbitrary code via an...
CVE-2017-15124
VNC server implementation in Quick Emulator QEMU 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto th...
Null pointer dereference
XRegion in TigerVNC allows remote VNC servers to cause a denial of service NULL pointer dereference by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052...
