Design/Logic Flaw

A use-after-free vulnerability during specific user interactions with the input method editor IME in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox 54, Firefox...

CVE-2017-7752

A use-after-free vulnerability during specific user interactions with the input method editor IME in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox 54, Firefox...

Directory Traversal

httpstaticsimple is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...

XenMobile: How to use PKI to create a certificate using the computer name?

On certain environments it is necesary to create a certificate using the computer name instead the username...

CVE-2017-7931

In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator URL on the web server, a malicious user is able to access the configuration files and application pages without authentication...

CVE-2017-17171

Some Huawei smart phones have the denial of service DoS vulnerability due to the improper processing of malicious parameters. An attacker may trick a target user into installing a malicious APK and launch attacks using a pre-installed app with specific permissions. Successful exploit could allow...

CVE-2017-17171

Summary: CVE-2017-17171 is a DoS vulnerability in some Huawei smartphones caused by improper processing of malicious parameters. A attacker could entice a user to install a malicious APK and leverage a pre-installed app with specific permissions to send crafted parameters to the phone driver, tri...

Stack overflow

SELA aka SimplE Lossless Audio v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c initapev2keys function...

ESTsoft ALZip Code Execution Vulnerability

ESTsoft ALZip is a compression tool from ESTsoft Korea. A security vulnerability exists in ESTsoft ALZip versions prior to 10.76. The vulnerability can be exploited by a local attacker to execute arbitrary code by creating a malicious .DLL file and installing it in a specific path...

Microsoft Guidance for Speculative Store Bypass

Executive summary On January 3, 2018, Microsoft released an advisory and security updates related to a newly-discovered class of hardware vulnerabilities known as Spectre and Meltdown involving speculative execution side channels that affect AMD, ARM, and Intel CPUs to varying degrees. On May 21s...

ESTsoft ALZip Arbitrary Code Execution Vulnerability

ESTsoft ALZip is a compression tool from ESTsoft Korea. A security vulnerability exists in ESTsoft ALZip versions prior to 10.76. The vulnerability can be exploited by a local attacker to execute arbitrary code by creating a malicious .DLL file and installing it in a specific path...

Valve: Suspended users can bypass UGC upload ban

Community-banned users could potentially upload UGC, though not associated with specific Steam games...

CVE-2018-10027

ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installing it in a specific directory: %PROGRAMFILES%\ESTsoft\ALZip\Formats, %PROGRAMFILES%\ESTsoft\ALZip\Coders, %PROGRAMFILESX86%\ESTsoft\ALZip\Formats, or...

Threat Outbreak Alert RuleID32754: Email Messages Distributing Malicious Software on May 10, 2018

Medium Alert ID: 57857 First Published: 2018 May 10 19:11 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32754 may contain the following files: Name | Size...

CVE-2018-9336

openvpnserv.exe aka the interactive service helper in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other...

The vulnerability of the `lim_process_action_vendor_specific` function in the Android WLAN operating system component from the CAF repository, which allows a hacker to disclose protected information

The vulnerability of the limprocessactionvendorspecific function in the Android WLAN operating system from the CAF repository arises due to an operation occurring outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is...

DRUPAL-CONTRIB-2018-021

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The module doesn't provide CSRF protection when processing authenticated traffic using cookie-based authentication. This vulnerability is mitigated by the fact that an...

CVE-2017-2804

A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific TIFF file to trigger this vulnerabilit...

CVE-2017-2803

A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 version 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific TIFF file to trigger this...

Out-of-bounds

Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20,...