CVE-2017-18302

In Snapdragon Automobile ,Mobile in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SnapdragonHighMed2016, a crafted HLOS client can modify the structure in memory passed to a QSEE...

The vulnerability of the CA Release Automation system arises from the restoration of an unreliable data structure in memory, allowing a perpetrator to execute arbitrary code.

The vulnerability of the CA Release Automation system arises from the restoration of a dubious data structure in memory. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code using a specially crafted serialized object...

Open .Git Directories Leave 390K Websites Vulnerable

A scan of more than 230 million web domains worldwide has uncovered 390,000 web pages with open .git directories – a worrying state of affairs that can expose a range of sensitive information. Researcher Vladimír Smitka at Lynt Services performed the scan, starting first in his native Czech...

ExchangeRelayX - An NTLM Relay Tool To The EWS Endpoint For On-Premise Exchange Servers (Provides An OWA For Hackers)

Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking interface, with...

Vulnerability of Microsoft COM components in Windows operating systems, allowing attackers to execute arbitrary code

The vulnerability of the Microsoft Component Object Model COM in Windows operating systems is related to the restoration of a dubious data structure in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file or script...

CVE-2018-16303

PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service resource consumption via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564...

CVE-2018-16303

PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service resource consumption via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564...

Sql injection

PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service resource consumption via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564...

UBUNTU-CVE-2018-16058

In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash. This was addressed in epan/dissectors/packet-btavdtp.c by properly initializing a data structure...

Microsoft Windows EMF File Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

The vulnerability of the library for working with SVG images in Apache Batik, related to the restoration of unreliable data structures in memory, allows attackers to gain access to protected data or cause service failures.

The vulnerability of the Apache Batik library for working with SVG images is related to the restoration of a dubious data structure in memory the “AbstractDocument” class. Exploiting this vulnerability could allow an attacker to gain access to protected data or cause service failures using the HT...

The vulnerability of the DNS server testing tool dnslint lies in its lack of protection for website structure, allowing attackers to execute arbitrary code.

The vulnerability of the DNS server testing tool dnslint exists because measures are not taken to protect the structure of web pages when generating reports. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted file that defines the rules for...

FreeBSD -- Resource exhaustion in TCP reassembly

Problem Description: One of the data structures that holds TCP segments uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. Impact: An attacker who has the ability to send...

Security Bulletins - IBM Planning Analytics, Cognos TM1 and Cognos Insight

Problem IBM Planning Analytics and Cognos TM1 Security Bulletins and Alerts. Resolving The Problem Tab navigation PA 2.0.x TM1 10.2.x Insight 10.2.x Concert 4.0.2 Security bulletins and Alerts for IBM Planning Analytics 2.0.x. --- Published / Updated | Title July 2018 | Security Bulletin: Multipl...

JavaScript Core - Arbitrary Code Execution Exploit

Exploit for multiple platform in category local exploits // Load Int library, thanks saelo! load'util.js'; load'int64.js'; // Helpers to convert from float to in a few random places var conva = new ArrayBuffer8; var convf = new Float64Arrayconva; var convi = new Uint32Arrayconva; var convi8 = new...

JavaScript Core - Arbitrary Code Execution

JavaScript Core - Arbitrary Code Execution // Load Int library, thanks saelo! load'util.js'; load'int64.js'; // Helpers to convert from float to in a few random places var conva = new ArrayBuffer8; var convf = new Float64Arrayconva; var convi = new Uint32Arrayconva; var convi8 = new...

Code injection

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

Delving deep into VBScript

In late April we found and wrote a description of CVE-2018-8174, a new zero-day vulnerability for Internet Explorer that was picked up by our sandbox. The vulnerability uses a well-known technique from the proof-of-concept exploit CVE-2014-6332 that essentially "corrupts" two memory objects and...

[SECURITY] Fedora 27 Update: redis-4.0.10-1.fc27

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Security Bulletin: Vulnerability in OpenSSL affects Tivoli Storage FlashCopy Manager Unix and VMware (CVE-2015-1788)

Summary An OpenSSL denial of service vulnerability disclosed by the OpenSSL Project affects GSKit. Tivoli Storage Manager Unix and VMware are affected as GSKit is used for communication between FCM components. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a deni...