Apple Safari Security Update (HT208324) - Mac OS X

Apple Safari is prone to multiple remote code execution RCE vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

PT-2017-17545

Name of the Vulnerable Software and Affected Versions iOS versions prior to 11.2 Description The issue involves the Mail Message Framework component and allows remote attackers to spoof the address bar via a crafted web site. Recommendations For iOS versions prior to 11.2, update to version 11.2 ...

KLA11163 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, obtain sensitive information, inject arbitrary code or spoof user interface. 1. A buffer overflow vulnerability in Direct ...

TIBCO tibbr web server component elevation of privilege vulnerability

TIBCO tibbr is a set of enterprise social platform software from TIBCO Software. The software includes features for posting news, making announcements, and sharing online. tibbr web server is one of the web server components. A security vulnerability exists in the tibbr web server component of...

KLA11153 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service and obtain sensitive information. 1. A buffer overflow vulnerability in Direct 3D 9 component can be exploited remotely to cause denial of service; 2. ...

Design/Logic Flaw

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority...

CVE-2017-13789

An issue was discovered in certain Apple products. Safari before 11.0.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site...

CVE-2017-13789

An issue was discovered in certain Apple products. Safari before 11.0.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site...

Symantec Endpoint Protection v12.1 / Tamper-Protection Bypass Exploit

Exploit for windows platform in category local exploits + Credits: John Page a.k.a hyp3rlinx Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint Protection v12.1.6 12.1 RU6 MP5 Symantec 12.1.7004.6500 Vulnerability Type: =================== Tamper-Protection Bypass Denial Of...

Symantec Endpoint Protection 12.1.6 Tamper Protection Bypass

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint...

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: =======...

CVE-2014-0072: Improper Input Validation

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin org.apache.cordova.file-transfer before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the...

CVE-2017-5104

Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via a crafted HTML page...

CVE-2017-5101

Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page...

UBUNTU-CVE-2017-5109

Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page...

UBUNTU-CVE-2017-5110

Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page...

UBUNTU-CVE-2017-5104

Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via a crafted HTML page...

CVE-2017-5101

Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page...

CVE-2017-5061: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

Puppet supports use of IP addresses in certnames without warning of potential risks

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address...