Announcing the Windows Defender Advanced Threat Protection ISO 27001 audit assessment report

The security and privacy of customer data are our top priority. Our goals are simple: to operate our services with the security and privacy you expect from Microsoft, and to give you accurate assurances about our security and privacy practices. In line with our commitment to provide customers the...

Bitwarden: Export vault feature is vulnerable to CSV injection

Hello guys I don't know if you care about this issue but it seems that the export feature in your https://vault.bitwarden.com//tools is vulnerable to CSV injection. If a CSV contains a malicious command it may have big impact Even though there is a popup notification for users before opening the...

Apple iOS 10.2 - Broadcom Out-of-Bounds Write when Handling 802.11k Neighbor Report Response

Apple iOS 10.2 - Broadcom Out-of-Bounds Write when Handling 802.11k Neighbor Report Response Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1289 The exploit gains code execution on the Wi-Fi firmware on the iPhone 7. The exploit has been tested against the Wi-Fi firmware as...

CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

Design/Logic Flaw

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

UBUNTU-CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

CVE-2017-12157

CVE-2017-12157 affects Moodle 3.x where certain course reports allow teachers to view details about users in groups they cannot access. The issue is described in multiple advisories and CVEs linked to Moodle sensitive information disclosure. Connected sources confirm affected product is Moodle, w...

The vulnerability of the UE component in the Android CAF-release operating system allows a perpetrator to compromise privacy, integrity, and accessibility.

The vulnerability of the UE component in the Android CAF-release operating system is related to positioning errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information when the UE driver sends unprotected...

Ledger CLI Tags Parsing Code Execution Vulnerability

Summary An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause a integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability. Tested...

NexusPHP reports.php file SQL injection vulnerability

NexusPHP is a resource sharing community solution written in PHP developed by the Nexus team in China. A SQL injection vulnerability exists in the reports.php file in NexusPHP version 1.5. A remote attack can exploit this vulnerability to execute arbitrary SQL commands with the 'delreport'...

Google Android Qualcomm Component Information Disclosure Vulnerability (CNVD-2017-27864)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA in the U.S. Qualcomm is one of the Qualcomm components used in Qualcomm devices. The Google Android Qualcomm group suffers from a piece of information disclosure vulnerability that...

Google Android Qualcomm Component Information Disclosure Vulnerability (CNVD-2017-27870)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA in the U.S. Qualcomm is one of the Qualcomm components used in Qualcomm devices. An information disclosure vulnerability exists in the Google Android Qualcomm component, which lead...

CVE-2017-12776

SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter...

CVE-2017-12776

SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter...

kanboard -- multiple privilege escalation vulnerabilities

chbi reports: an authenticated standard user could reset the password of another user including admin by altering form data...

sqlite3 -- heap-buffer overflow

Google reports: A heap-buffer overflow sometimes a crash can arise when running a SQL request on malformed sqlite3 databases...

The MSRC 2017 list of “Top 100” security researchers

Security researchers play an essential role in Microsoft’s security strategy and are key to community-based defense. To show our appreciation for their hard work and partnership, each year at BlackHat North America, the Microsoft Security Response Center highlights contributions of these...