Command Execution Vulnerability in the set_param Program of the Pelco Sarix Pro Network Camera

pelco Sarix Professional is a video camera. A command execution vulnerability exists in the pelco Sarix Pro network camera setparam program. The vulnerability is caused due to the program not performing security checks on user-submitted parameters, allowing an attack to take full control of the...

The vulnerability of the packet_set_ring function in the kernel of Linux operating systems allows a attacker to increase their privileges, cause service failures, or execute arbitrary code.

The vulnerability of the packetsetring function in the Linux operating system’s kernel is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, who has local privileges as CAPNETRAW, to create PFPACKET sockets, initiate racing states and memory usage...

The vulnerability of the ALEOS software, a wireless modem from Sierra Wireless, allows a hacker to gain access to the system by exploiting pre-installed credentials.

The vulnerability of the ALEOS software for the Sierra Wireless AirLink GX 440 wireless modem lies in the use of pre-set login credentials. Exploiting this vulnerability allows a malicious actor to gain access to the system with privileges of one of the users: admin, rauser, sconsole, or user, by...

Octopus Deploy XSS Vulnerability

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

DEBIAN-CVE-2017-11089

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211setstation when user space application sends attribute NL80211ATTRLOCALMESHPOWERMODE with data of size less than 4 bytes...

Buffer overflow

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, possible buffer overflow or information leak in the functions "smesetfties" and "csrroamissueftpreauthreq" due to incorrect initialization of WEXT callbacks and lack of the checks for...

UBUNTU-CVE-2017-11089

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211setstation when user space application sends attribute NL80211ATTRLOCALMESHPOWERMODE with data of size less than 4 bytes...

Microsoft Edge: Memory corruption with Object.setPrototypeOf(CVE-2017-8751)

I accidentally found this while trying to reproduce another bug in Edge. Failed to reproduce on Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393. Tested on Microsoft Edge 40.15063.0.0, Microsoft EdgeHTML 15.15063 Insider Preview. Crash Log: First chance exceptions are reported before a...

CVE-2017-16810

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 fixed in 3.13.7 allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 fixed in 3.13.7 allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter...

CVE-2017-16810

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 fixed in 3.13.7 allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter...

Octopus Deploy 'Variable Set Name' Parameter Cross-Site Scripting Vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A cross-site scripting vulnerability exists in the All Variables tag in Octopus Deploy versions 3.4.0-3.13.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or...

CVE-2017-10946

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2015-0224

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service daemon crash via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203...

Fedora 26 : glibc (2017-2c63df4fe3)

This update addresses various minor issues in the glibc package : - The DNS stub resolver now picks up changes to /etc/resolv.conf automatically RHBZ1374239. - The DNS stub resolver supports an unlimited number of search domains RHBZ168253. - CVE-2015-5180, a segmentation fault potentially...

The vulnerability of the `xt_alloc_table_info` function in the kernel’s `net/netfilter/x_tables.c` file in the Linux operating system allows a hacker to escalate their privileges or cause service interruptions.

The vulnerability of the xtalloctableinfo function in the kernel’s net/netfilter/xtables.c file in the Linux operating system is caused by a numerical overflow. Exploiting this vulnerability could allow an attacker, operating locally, to increase their privileges or cause a service failure memory...

Bad Rabbit – Ransomware

updated: 10/26/2017 with additional file hashes and mitigations A new ransomware campaign has affected at least three Russian media companies in a fast-spreading malware attack. Fontanka and Interfax are among the companies affected by the Bad Rabbit ransomware named by the researchers who first...

Unbreakable Enterprise kernel security update

2.6.39-400.297.11 - mqueue: fix a use-after-free in sysmqnotify Cong Wang Orabug: 26643562 CVE-2017-11176 - ipv6: avoid overflow of offset in ip6find1stfragopt Sabrina Dubroca Orabug: 27011278 CVE-2017-7542 - packet: fix tpreserve race in packetsetring Willem de Bruijn Orabug: 27002453...

Apple iOS Time has an unspecified vulnerability

Apple iOS is an operating system developed by Apple Inc. for mobile devices.Time component is one of the time components. A security vulnerability exists in the Time component of Apple iOS prior to version 11, which arises from the possibility that the program fails to properly handle the use of...

British Columbia Institute of Technology CodeIgniter HTTP Packet Header Injection Vulnerability

British Columbia Institute of Technology CodeIgniter is the British Columbia Institute of Technology British Columbia Institute of Technology for PHP web developers to use a set of application development framework and toolkit . An HTTP packet header injection vulnerability exists in the...