Security Advisory - Information Leak Vulnerability in Huawei Hilink APP

Huawei Hilink APP has an information leak vulnerability. An attacker may trick a user into installing a malicious application and application can access Hilink APP data. Vulnerability ID: HWPSIRT-2017-01092 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...

Security Advisory - Phone Finder Bypass Vulnerability in Some Huawei Smart Phones

Phone Finder is a Huawei security method that was designed to make sure someone can't just wipe and factory reset the phone if user lost it or it was stolen. The Phone Finder in some Huawei smart phones can be bypass. An attacker can bypass the Phone Finder by special steps and obtain the owner o...

Security Advisory - Apache Struts2 Remote Code Execution Vulnerability in Huawei Products

Apache Struts2 released a remote code execution vulnerability in S2-045 on the official website. An attacker is possible to perform a RCE Remote Code Execution attack with a malicious Content-Type value. Vulnerability ID: HWPSIRT-2017-03094 This vulnerability has been assigned a CVE ID:...

Cisco Mobility Express 1800 Access Point Series Authentication Bypass Vulnerability

A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. The vulnerability is due to improper implementation of authentication for...

Cisco Meshed Wireless LAN Controller Impersonation Vulnerability

A vulnerability in the mesh code of Cisco Wireless LAN Controller WLC software could allow an unauthenticated, remote attacker to impersonate a WLC in a meshed topology. The vulnerability is due to insufficient authentication of the parent access point in a mesh configuration. An attacker could...

Cisco Workload Automation and Tidal Enterprise Scheduler Client Manager Server Arbitrary File Read Vulnerability

A vulnerability in the Client Manager Server of Cisco Workload Automation and Cisco Tidal Enterprise Scheduler could allow an unauthenticated, remote attacker to retrieve any file from the Client Manager Server. The vulnerability is due to insufficient input validation. An attacker could exploit...

Cisco StarOS SSH Privilege Escalation Vulnerability

A privilege escalation vulnerability in the Secure Shell SSH subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root shell access. The...

Microsoft Windows Uniscribe CVE-2017-0088 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file or webpage. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Failed explo...

Microsoft Internet Explorer and Edge CVE-2017-0033 Spoofing Vulnerability

Description Microsoft Internet Explorer and Edge are prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected...

Microsoft Windows Uniscribe CVE-2017-0083 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file or webpage. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Failed explo...

Microsoft Windows CVE-2017-0039 DLL Loading Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can leverage this issue to execute arbitrary code with elevated privileges. Technologies Affected Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microso...

Microsoft Windows DVD Maker CVE-2017-0045 Cross Site Request Forgery Vulnerability

Description Microsoft Windows DVD Maker is prone to an unspecified cross-site request forgery vulnerability because it fails to properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application...

Cybozu KUNAI for Android information management vulnerability

Overview Cybozu KUNAI for Android is a mobile client software for using Cybozu from an Android device. Cybozu KUNAI for Android provides a function to output log information when synchronizing data with Cybozu, however the function is disabled by default. Cybozu KUNAI for Android contains an issu...

JVN#88745657: Cybozu KUNAI for Android information management vulnerability

Cybozu KUNAI for Android is a mobile client software for using Cybozu from an Android device. Cybozu KUNAI for Android provides a function to output log information when synchronizing data with Cybozu, however the function is disabled by default. Cybozu KUNAI for Android contains an issue where i...

MGASA-2017-0076 Updated wireshark packages fix security vulnerability

The wireshark package has been updated to version 2.0.11, which fixes two security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details...

MGASA-2017-0074 Updated flac packages fix security vulnerability

FLAC 1.3.2 fixes a NULL pointer dereference bug and adds bounds checking in the encoder. It also fixes various non security-relevant issues...

Security Advisory - Information Leak Vulnerability in Huawei APP

Some Huawei APPs have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version. Vulnerability ID: HWPSIRT-2017-02025 This vulnerability has been assigned a CV...

SUSE-SU-2017:0644-1 Security update for xorg-x11-libX11

This update for xorg-x11-libX11 fixes the following issues: - a regression introduced by the security fix for CVE-2013-1997 bnc824294. Keyboard mappings for special characters on Non-English keyboards might have been broken. bnc1019642...

OneThird CMS vulnerable to cross-site scripting

Overview OneThird CMS provided by SpiQe Software contains a cross-site scripting vulnerability CWE-79 due to an issue in processing the inquiry form. Note that this vulnerability is different from JVN49408248. Satoshi Takagi of Cryptography Laboratory,Department of Information and Communication...

BookLibrary,3.6.14,SQL Injection

BookLibrary by Ordasoft, 3.6.14, SQL Injection Resolutiion: Update to 3.6.15 Update notice: http://ordasoft.com/News/News/book-library-security-update.html...