Samsung Magician Remote Code Execution Vulnerability

Samsung Magician is software for Samsung SSDs that provides performance testing, performance optimization, and firmware upgrades for SSDs. A remote code execution vulnerability exists in Samsung Magician due to the program failing to properly validate TLS certificates for HTTPS software update...

CVE-2017-4989

In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited by an attacker to view sensitive information,...

Authentication flaw

In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited by an attacker to view sensitive information,...

Code injection

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3218

Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3219

CVE-2017-3219 affects Acronis True Image up to 2017 Build 8053, which performs software updates over HTTP with updates only verified by a server-provided MD5 hash. This design allows a potential attacker on the same network or able to influence traffic to cause the update process to execute arbit...

CVE-2017-4989

CVE-2017-4989 affects EMC Avamar Server Software releases listed (7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401). Root cause: unauthenticated remote bypass of authentication to access the system maintenance page, enabling viewing of sensitive info and execution of maintenance tas...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

Cisco Prime Infrastructure and Evolved Programmable Network Manager XML Injection Vulnerability

A vulnerability in the web-based user interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker mu...

Cisco WebEx Network Recording Player Multiple Buffer Overflow Vulnerabilities

Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Network Recording Player for Advanced Recording Format ARF files. An attacker could exploit these vulnerabilities by providing a user with a malicious ARF file via email or URL and convincing the user to launch the file. Exploitati...

PT-2017-2438

Name of the Vulnerable Software and Affected Versions EMC Avamar Server Software versions 7.2.0-401 through 7.3.1-125 Description The issue is related to weaknesses in the authentication procedure of the EMC Avamar backup system. It may allow a remote attacker to bypass authentication, gaining...

CVE-2017-3219: Missing Encryption of Sensitive Data

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

PT-2017-15710

Name of the Vulnerable Software and Affected Versions Samsung Magician versions prior to 5.0 Description The issue concerns the failure to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates. Recommendations For versio...

HPSBPI03556 rev 1 - HP Web Jetadmin, Denial of Service

Potential Security Impact HP Web Jetadmin, potential denial of service Reported by: Konrad Ferbes and Vojtěch Dziewięcki from F-Secure VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP Web Jetadmin. This vulnerability could potentially be exploited to create a...

Security Advisory - Use After Free Vulnerability in TEE Module of Some Huawei Smart Phones

The Trusted Execution Environment TEE module driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to create and free specific memory, which could trigger...

Security Advisory - Permission Control Vulnerability in Smart Phones

Some Huawei Smart phones have a permission control vulnerability. Due to improper authorization on specific processes, an attacker with the root privilege of a mobile Android system can exploit this vulnerability to obtain some information of the user. Vulnerability ID: HWPSIRT-2017-04123 This...

Security Advisory - Permission Control Vulnerability in Smart Phones

Some Huawei Smart phones have a permission control vulnerability. Due to improper authorization on specific processes, an attacker with the root privilege of a mobile Android system can exploit this vulnerability to obtain some information of the user. Vulnerability ID: HWPSIRT-2017-04123 This...

Microsoft Outlook CVE-2017-8507 Memory Corruption Vulnerability

Description Microsoft Outlook is prone to a remote memory-corruption vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected...

Microsoft SharePoint Server CVE-2017-8551 Remote Privilege Escalation Vulnerability

Description Microsoft SharePoint Server is prone to a remote privilege-escalation vulnerability because it fails to properly sanitize user-supplied input. An attackers may exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Technologies Affected Microso...