Design/Logic Flaw

The Device Administrator code in Android before 4.4.1r1 might allow attackers to spoof device administrators and consequently bypass MDM restrictions by leveraging failure to update the mAdminMap data structure...

Exiv2 IptcData::printStructure Information Disclosure Vulnerability

Exiv2 is a C++ library for extracting EXIF, LPTC and XMP metadata information from images. An information disclosure vulnerability exists in Exiv2 version 0.26 iptc.c/IptcData::printStructure, which can be exploited by an attacker to cause a crash or information disclosure...

The vulnerability of the Cisco Secure Access Control System’s access control software lies in the ability to restore a questionable data structure in memory, allowing an intruder to execute arbitrary commands with root privileges.

The vulnerability of the Cisco Secure Access Control System ACS management software exists due to insufficient validation of input data and the inability to restore a reliable data structure in memory. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary...

Microsoft Windows - 'nt!NtQuerySystemInformation (SystemPageFileInformation(Ex))' Kernel 64-bit Stack Memory Disclosure

/ We have discovered that the nt!NtQuerySystemInformation system call invoked with the SystemPageFileInformation 0x12 and SystemPageFileInformationEx 0x90 information classes discloses uninitialized kernel stack memory to user-mode clients. The vulnerability affects 64-bit versions of Windows 7 t...

Natus Xltek EEG NeuroWorks NewProducerStream Use of Return Value Denial of Service Vulnerability

Summary An exploitable Denial of Service vulnerability exists in the use of a return value in the NewProducerStream command in Natus Xltek NeuroWorks 8. A specially crafted network packet can cause an out of bounds read resulting in a denial of service. An attacker can send a malicious packet to...

The vulnerability of the NVBUPolicy Get request handler in NetVault Backup software allows a attacker to execute arbitrary code.

The vulnerability of the NVBUPolicy Get request handler in NetVault Backup software for data archiving and restoration is related to insufficient protection of the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the NVBUPhaseStatus Count request handler in the NetVault Backup software allows a attacker to execute arbitrary code.

The vulnerability of the NVBUPhaseStatus Count processing component in NetVault Backup software relates to insufficient protection of the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2017-14915: Use After Free

In Android before 2018-01-05 on Qualcomm Snapdragon Mobile SD 625, SD 650/52, SD 835, accessing SPCOM functions with a compromised client structure can result in a Use After Free condition...

The vulnerability of the NVBUBackupOptionSet Get request handler in the NetVault Backup software allows a attacker to execute arbitrary code.

The vulnerability of the NVBUBackupOptionSet Get request handler in the NetVault Backup data archiving and restoration software lies in the insufficient protection of the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Windows Kernel 64-bit pool memory disclosure in win32k!UMPDOBJ::LockSurface(CVE-2018-0813)

We have discovered that the win32k!UMPDOBJ::LockSurface function discloses portions of uninitialized pool memory to user-mode clients. The bug was encountered on Windows 7 64-bit; other versions were not tested. The leak was detected in the context of the splwow64.exe process, under the following...

Windows Kernel 64-bit pool memory disclosure via REG_RESOURCE_LIST registry values (CmResourceTypeDevicePrivate entries)(CVE-2018-0898)

We have discovered a Windows kernel memory disclosure vulnerability through the body of "AllocConfig" registry values of type REGRESOURCELIST, which can be found under HKLM\SYSTEM\CurrentControlSet\Enum\\Control\AllocConfig. The vulnerability affects 64-bit versions of Windows 7 to 10. The leak...

CVE-2017-18241

fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service NULL pointer dereference and panic by using a noflushmerge option that triggers a NULL value for a flushcmdcontrol data structure...

CVE-2017-18241

fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service NULL pointer dereference and panic by using a noflushmerge option that triggers a NULL value for a flushcmdcontrol data structure...

CVE-2017-18241

fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service NULL pointer dereference and panic by using a noflushmerge option that triggers a NULL value for a flushcmdcontrol data structure...

Microsoft Internet Explorer VML textpath Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

The vulnerability of the WebDMDebugServlet component of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the WebDMDebugServlet component of the HPE Intelligent Management Center PLAT software lies in the ability to restore an unreliable data structure in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the SYSTEM context remotely...

PT-2018-17691

Name of the Vulnerable Software and Affected Versions Design Science MathType version 6.9c Description A Remote Code Execution issue was discovered, where crafted input can overwrite a structure, leading to a function call with an invalid parameter, and a subsequent free of important data...

Protobuf-Inspector - Tool To Reverse-Engineer Protocol Buffers With Unknown Definition

Simple program that can parse Google Protobuf encoded blobs version 2 or 3 without knowing their accompanying definition. It will print a nice, colored representation of their contents. Example: As you can see, the field names are obviously lost, together with some high-level details such as:...

Windows Kernel stack memory disclosure in nt!RtlpCopyLegacyContextX86(CVE-2018-0832)

We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a CONTEXT structure to user-mode memory. Two previous bugs in the nearby code area were reported in issues 1177 and 1311 ; in fact, the problem discussed here appears to be a variant of 1177 but...

Microsoft Windows Kernel - nt!RtlpCopyLegacyContextX86 Stack Memory Disclosure Exploit

Exploit for windows platform in category dos / poc / We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a CONTEXT structure to user-mode memory. Two previous bugs in the nearby code area were reported in issues 1177 and 1311 ; in fact, the probl...