Microsoft Windows 'libjpeg' Information Disclosure Vulnerability (KB4014794)

This host is missing an important security update according to Microsoft KB4014794. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Windows 8.1 and Windows Server 2012 R2 April 2017 Security Updates

The remote Windows host is missing security update 4015547 or cumulative update 4015550. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the open-source libjpeg image processing library due to improper handling of objects in memory. An...

Security Update for Microsoft Office Products (April 2017) (Petya)

The Microsoft Office application, Office Web Apps, or SharePoint Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - An arbitrary code execution vulnerability exists in Microsoft Outlook due to improper parsing of...

Microsoft Fixes 45 Vulnerabilities with new Security Update Guide – says goodbye to Security Bulletins

Today is the first month since 1998 in which Microsoft stopped releasing security bulletins with the familiar MSxx-xxx format and replaced it with the new security update guide. We talked about this change earlier in a few blog posts and finally today it’s time to say good bye to security bulleti...

libjpeg Information Disclosure Vulnerability

An information disclosure vulnerability exists within the open-source libjpeg image-processing library where it fails to properly handle objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization ASLR bypass. An attacker who successful...

ADFS Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when ADFS incorrectly treats requests coming from Extranet clients as Intranet requests. To exploit this vulnerability, an attacker could run a specially crafted application and attempt to brute-force an account password. An attacker who successfully...

KLA11059 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, bypass security restrictions, cause denial of service. Below is a complete list of vulnerabilities: 1. A remote cod...

Samsung Galaxy S8's Facial Unlocking Feature Can Be Fooled With A Photo

Samsung launched its new flagship smartphones, the Galaxy S8 and Galaxy S8 Plus, at its Unpacked 2017 event on Wednesday in New York, with both IRIS and Facial Recognition features, making it easier for users to unlock their smartphone and signing into websites. All users need to do is simply hol...

Security feature bypass

The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 because of missing a check in the findlink function for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash...

Security feature bypass

Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without invalidating associated signatures, aka "PowerShell Security Feature Bypass Vulnerability."...

CVE-2017-0135

CVE-2017-0135 describes a security feature bypass in Microsoft Edge enabling a SOP bypass for HTML elements across browser windows. The core official description notes it is distinct from CVE-2017-0066/0140. A connected article discusses bypassing Edge’s XSS filter/CSP handling, but the provided ...

CVE-2017-0066

Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability." This vulnerability is different from those described in CVE-2017-0135 and CVE-2017-0140...

Security feature bypass

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...

Device Guard Security Feature Bypass Vulnerability

A security feature bypass exists when Device Guard does not properly validate certain elements of a signed PowerShell script. An attacker who successfully exploited this vulnerability could modify the contents of a PowerShell script without invalidating the signature associated with the file...

Microsoft Lync for Mac Certificate Validation Vulnerability

A security feature bypass exists when the Lync for Mac 2011 client fails to properly validate certificates. An attacker who successfully exploited this vulnerability could tamper with trusted communications between the server and target client. To exploit the vulnerability, an attacker would need...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy SOP restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploite...

Microsoft Device Guard Security Feature Bypass (MS17-012: CVE-2017-0007)

A security feature bypass vulnerability has been reported in Microsoft Windows Device Guard. The vulnerability is due to the way Device Guard improperly validates certain elements of a signed PowerShell script. A remote attacker could exploit this vulnerability by enticing a target user to open a...

Microsoft Edge Security Feature Bypass (MS17-007: CVE-2017-0066)

Security feature bypass exists in Microsoft Edge. The vulnerability is due to an error in Microsoft Edge while handling a specially crafted HTML file. A remote attacker can exploit this issue by enticing a user to open a specially crafted web-page with an affected version of Microsoft Edge...

KLA10967 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure...

Microsoft Edge Security Feature Bypass (MS17-007: CVE-2017-0140)

Security feature bypass exists in Microsoft Edge. The vulnerability is due to a breach in the way Microsoft Edge implements SOP Same Origin Policy for HTML elements present in other browser windows. A remote attacker could exploit this vulnerability by enticing a user to visit a maliciously craft...