5806 matches found
Security Advisory - Input Validation Vulnerability in Multiple Huawei Products
There is an input validation vulnerability in Huawei Multiple products. Due to the lack of input validation on the device, a remote attacker may exploit this vulnerability by crafting a malformed packet and sending it to the device. A successful exploit could allow the attacker to cause a denial ...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is a denial of service DoS vulnerability in some Huawei smart phones due to the input parameters validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can send given parameter to specific interface, which make a large number of...
Microsoft Addresses Shadow Brokers Exploits
The Microsoft Security Response Center MSRC has published information on several recently publicized exploit tools which affect various Microsoft products. Users and administrators are reminded that software no longer supported by Microsoft also known as end-of-life EOL software is particularly a...
Microsoft Windows Hyper-V CVE-2017-0162 Remote Code Execution Vulnerability
Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits allow attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial of service condition. Technologies Affected Microsoft Window...
Microsoft Edge CVE-2017-0200 Scripting Engine Remote Memory Corruption Vulnerability
Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Edge Recommendations...
Microsoft Edge CVE-2017-0205 Remote Memory Corruption Vulnerability
Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Edge Recommendations...
Microsoft Edge CVE-2017-0093 Scripting Engine Remote Memory Corruption Vulnerability
Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Edge Recommendations...
Cisco Wireless LAN Controller 802.11 WME Denial of Service Vulnerability
A vulnerability in 802.11 Wireless Multimedia Extensions WME action frame processing in Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The vulnerability is due to incomplete input validation of the 802.11 WM...
Security Advisory - Multiple Buffer Overflow Vulnerabilities in Bastet of Huawei Smart Phone
The Bastet of some Huawei mobile phones have three buffer overflow vulnerabilities due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the...
Authentication Bypass Vulnerability in Huawei SkyTone
Huawei SkyTone products have an authentication bypass vulnerability. An unauthenticated attacker may craft specific message to the affected products' server. Due to insufficient authentication, the attacker may bypass the authentication and make some functions abnormal. Vulnerability ID:...
Programmers are also people who also make mistakes
It's the first part of our talk with Daniil Svetlov at his radio show "Safe Environment" or "Safe Wednesday" - kind of wordplay in Russian recorded 29.03.2017. We were discussing why Software Vulnerabilities are everyone's problem. Full video in Russian without subtitles is available here. I adde...
Security Advisory - Several Vulnerabilities on the VCM5010
There is a command injection vulnerability on the VCM5010. This is due to insufficient validation of user's input. An authenticated attacker could launch a command injection attack. Vulnerability ID: HWPSIRT-2016-12094 This vulnerability has been assigned a Common Vulnerabilities and Exposures CV...
Security Advisory - Exposed System Interface Vulnerability on Huawei Smart Phones
There is a exposed system interface vulnerability on smart phones. The software provides a system interface for interaction with external applications, but calling the interface is not properly restricted. An attacker could trick the user into installing a malicious application to call the...
Cisco Patches Critical IOx Vulnerability
Cisco Systems patched a critical vulnerability Wednesday that could allow an unauthenticated, remote attacker to execute remote code on affected hardware and gain root privileges. The bug is in Cisco’s Data-in-Motion DMo process, part of the company’s IOx application environment that marries its...
Security Advisory - Bluetooth Unlock Bypassing Vulnerability in Some Huawei Mobile Phones
Some Huawei mobile phones have a Bluetooth unlock bypassing vulnerability due to the lack of validation on Bluetooth devices. If a user has enabled the smart unlock function, an attacker can impersonate the user's Bluetooth device to unlock the user's mobile phone screen. Vulnerability ID:...
Cisco Application-Hosting Framework Directory Traversal Vulnerability
A vulnerability in the web framework code of the Cisco application-hosting framework CAF component of the Cisco IOx application environment could allow an unauthenticated, remote attacker to read any file from the CAF in the virtual instance running on the affected device. The vulnerability is du...
Cisco IOS XE Software HTTP Command Injection Vulnerability
A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...
Cisco Application-Hosting Framework Arbitrary File Creation Vulnerability
A vulnerability in the Cisco application-hosting framework CAF component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The vulnerability is due to insufficient input...
Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability
A vulnerability in the Cisco Cluster Management Protocol CMP processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes...
Security Advisory - DoS Vulnerability in Vibrator Service of Huawei Smart Phones
The vibrator service of some Huawei smart phones has DoS vulnerability due to the lack of a parameters check. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone vibrator service interface to crash the system...