CVE-2017-14227

In MongoDB libbson 1.7.0, the bsonitercodewscope function in bson-iter.c miscalculates a bsonutf8validate length argument, which allows remote attackers to cause a denial of service heap-based buffer over-read in the bsonutf8validate function in bson-utf8.c, as demonstrated by bson-to-json.c...

CVE-2017-14130

The bfdelfparseattributes function in elf-attrs.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service bfdelfattrstrdup heap-based buffer over-read and application crash via a crafted ELF file...

CVE-2015-5958

The CVE-2015-5958 issue affects phpFileManager 0.9.8 and is a remote code execution vulnerability. A crafted URL can cause the tool to execute arbitrary OS commands on the affected system, as documented by multiple sources (including advisories and the Metasploit module). The vulnerability permit...

CVE-2017-13710

The setupgroup function in elf.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a group section that is too small...

CVE-2015-5224

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks...

Code injection

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks...

Rowhammer Attacks Come to MLC NAND Flash Memory

The Rowhammer attacks developed by Google more than two years ago put the focus on hardware front and center. That research allowed attackers to flip dynamic random access memory DRAM bits in order to induce those memory cells to change their state. Google’s research enabled kernel-level privileg...

USN-3382-1: PHP vulnerabilities

It was discovered that the PHP opcache created keys for files it cached based on their filepath. A local attacker could possibly use this issue in a shared hosting environment to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS. CVE-2015-8994 It was discovered that the PHP...

CVE-2014-9831

coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file...

CVE-2015-7701

Memory leak in the CRYPTOASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service memory consumption...

CVE-2017-12454

The bfdvmsslurpegsd function in bfd/vms-alpha.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file...

Two Popular IP Cameras Riddled With Vulnerabilities

Two consumer-grade IP-enabled security cameras manufactured by Loftek and VStartcam are riddled with nearly two dozen vulnerabilities that expose them to remote attacks. According to researchers, more than 1.3 million of the cameras are in use today, with 200,000 models located in the United...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

Vulnerabilities in Car Washes

Articles about serious vulnerabilities in IoT devices and embedded systems are now dime-a-dozen. This one concerns Internet-connected car washes: A group of security researchers have found vulnerabilities in internet-connected drive-through car washes that would let hackers remotely hijack the...

CVE-2017-9491

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST; Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST; Cisco DPC3939B firmware version dpc3939b-v303r204217-150321a-CMCST; Cisco DPC3941T firmware version DPC39412.5s3PRODsey; an...

Google Chrome Security Updates (stable-channel-update-for-desktop-2017-07) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Google Chrome Security Updates (stable-channel-update-for-desktop-2017-07) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Design/Logic Flaw

In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters .. -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack...

CVE-2017-7030

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote...

CVE-2017-7048

CVE-2017-7048 affects WebKit components across Apple products (iOS 10.x, Safari 10.x, tvOS 10.x, iCloud/iTunes on Windows) and WebKitGTK+ before 2.16.6. In Apple products, the issue is described as memory corruption leading to remote code execution or a crash via a crafted web site; WebKitGTK+ re...