CVE-2015-2454

CVE-2015-2454 concerns a vulnerability in the Windows kernel-mode driver where impersonation level handling is not properly constrained. The issue allows a local attacker to gain privileges by crafting an application, affecting multiple Windows versions listed in the initial document (Vista SP2, ...

Microsoft Windows Kernel KMD Security Feature Bypass Vulnerability

Microsoft Windows is a series of operating systems released by the American company Microsoft. A security feature bypass vulnerability exists in Microsoft Windows Kernel KMD, which can be exploited by an attacker to elevate privileges...

MS15-080 : Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (3078662)

The remote Windows host is affected by multiple vulnerabilities : - Multiple remote code execution vulnerabilities exist due to the Windows Adobe Type Manager Library not properly handling specially crafted OpenType fonts. An attacker can exploit these, by using a crafted document or web page wit...

MS15-089: Vulnerability in WebDAV could allow security feature bypass: August 11, 2015

None None...

IBM DB2 9.7 < Fix Pack 11 Multiple Vulnerabilities (Bar Mitzvah) (FREAK) (TLS POODLE)

According to its version, the installation of IBM DB2 9.7 running on the remote host is prior to Fix Pack 11. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the monitoring and audit features that occurs when handling a specially crafte...

Security feature bypass

Unspecified vulnerability in the Hyperion Enterprise Performance Management Architect component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-2584...

Security feature bypass

Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to bypass the ASLR protection mechanism via a crafted spreadsheet, aka "Microsoft Excel ASLR...

Security feature bypass

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

CVE-2015-1936

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

Microsoft Internet Explorer ASLR Bypass (MS15-065: CVE-2015-2421)

A security feature bypass vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to improper implementation of the Address Space Layout Randomization ASLR security feature. A remote attacker can exploit this issue by enticing a user to open a specially crafted...

Security feature bypass

PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass...

Microsoft Internet Explorer VBScript Memory Corruption (MS15-053: CVE-2015-1684)

A security feature bypass vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due an error while processing regular expressions which allows a user to disclose memory contents of the current process. A remote attacker can exploit this issue to bypass the ASLR...

Apache Tomcat 8.0.x < 8.0.21 Multiple Vulnerabilities (FREAK)

According to its self-reported version number, the Apache Tomcat server listening on the remote host is 8.0.x prior to 8.0.21. It is, therefore, affected by the following vulnerabilities : - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is...

Apache Tomcat 7.0.x < 7.0.60 Multiple Vulnerabilities (FREAK)

According to its self-reported version number, the Apache Tomcat service listening on the remote host is 7.0.x prior to 7.0.60. It is, therefore, affected by the following vulnerabilities : - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is...

Security feature bypass

Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."...

Security feature bypass

VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass."...

Microsoft Releases May 2015 Security Bulletin

Microsoft has released 13 updates to address vulnerabilities in Microsoft Windows. Some of these vulnerabilities could allow elevation of privilege, denial of service, remote code execution, information disclosure, or security feature bypass. US-CERT encourages users and administrators to review...

MS15-053: Vulnerabilities in JScript and VBScript Scripting Engines Could Allow Security Feature Bypass (3057263)

The JScript and/or VBScript scripting engines installed on the remote Windows host are affected by multiple ASLR security feature bypass vulnerabilities, which allow an attacker to more reliably predict the memory offsets of specific instructions in a given call stack. A remote attacker can explo...

Juniper NSM < 2012.2R11 Multiple OpenSSL Vulnerabilities (JSA10679) (FREAK)

The remote host is running a version of NSM Network and Security Manager Server that is prior to 2012.2R11. It is, therefore, affected by multiple vulnerabilities related to OpenSSL : - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is received...

Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10679) (FREAK)

According to its self-reported version number, the remote Juniper Junos device is affected by the following vulnerabilities related to OpenSSL : - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is received. This allows a remote attacker, using ...