Information disclosure

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map...

CVE-2017-5891

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF...

CVE-2017-8877

Consolidated risk: CVE-2017-8877 affects ASUS RT-AC* and RT-N* routers with firmware up to 3.0.0.4.380.7378. The connected CNVD entry and NVD description indicate an information-disclosure flaw in which JSONP responses can reveal sensitive data (notably the SSID). No explicit exploit details, aff...

CVE-2017-8878

This entry covers ASUS RT-AC* and RT-N* routers with firmware prior to 3.0.0.4.380.7378. It describes an information-disclosure vulnerability where remote authenticated users can obtain the Wi-Fi password via WPS_info.xml. Impact is partial confidentiality (password exposure) with no integrity or...

CVE-2017-5892

ASUS RT-AC* and RT-N* routers with firmware older than 3.0.0.4.380.7378 expose a JSONP information-disclosure flaw that can reveal router data such as a network map. The vulnerability is covered by CVE-2017-5892. Most CSRF-related issues were fixed in firmware 3.0.0.4.380.7378; the JSONP informat...

CVE-2017-5891

CVE-2017-5891 covers CSRF vulnerabilities in ASUS RT-AC* and RT-N* routers prior to firmware 3.0.0.4.380.7378, enabling login and settings changes via the router’s web interface from an attacker-controlled site. Affected models include RT-AC55U/56R/56S/56U/66U/66R/66W/66U family, RT-AC68K/R/U var...

OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0100)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix DNSKEY that encountered a CNAME 1447869, ISC change 3391 - Fix CVE-2017-3136 ISC change 4575 - Fix CVE-2017-3137 ISC change 4578 - Fix and test caching CNAME before DNAME ISC change 4558 - Fix...

Security update for Adobe Flash Player: May 9, 2017

None None...

CVE-2017-0290

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not...

KLA11012 Remote code execution vulnerability in the Microsoft Malware Protection Engine

An improper way of scanning files was found in the Microsoft Malware Protection. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed file. Technical details To exploit this vulnerability, a malformed fi...

Spoofed Server Attacks

cxf-rt-rs-security-xml is vulnerable to server spoofing attacks. The attacks are possible because the XML security clients fail to validate whether the JAX-RS service response is signed or encrypted...

RHEL 6 : kernel-rt (RHSA-2017:0932)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0932 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

RHEL 7 : kernel-rt (RHSA-2017:0931)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0931 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

Information disclosure

A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could...

CVE-2017-0158

CVE-2017-0158 is a Windows scripting engine memory corruption vulnerability. The issue arises from improper handling/sanitization of in-memory handles in the Scripting Engine, enabling remote code execution when a user visits a malicious site or opens a crafted document. Affected platforms includ...

CVE-2017-0188

CVE-2017-0188 concerns a Win32k information-disclosure vulnerability in Windows 8.1/RT 8.1, Windows Server 2012/2012 R2, Windows 10, and Windows Server 2016. The win32k component improperly provides kernel information, enabling an attacker who can exploit the issue to obtain information that coul...

CVE-2017-0188

A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could...

Microsoft Windows OLE CVE-2017-0211 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code within the context of the application. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 16...

Microsoft Windows ATMFD.dll CVE-2017-0192 Information Disclosure Vulnerability

Description Microsoft Windows is prone to an information-disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607...

ASUS WRT Cross Site Scripting Nmap NSE Script

local http = require "http" local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local vulns = require "vulns" local nmap = require "nmap" description = ASUSWRT is a wireless router operating system that powers many routers produced by ASUS...