1636 matches found
Code injection
An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmware version 1.2.0...
CVE-2018-15358
An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmware version 1.2.0...
CVE-2018-15359
An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-200 firmware version 1.2.0...
CVE-2018-15125
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface...
CVE-2018-15125
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface...
Information disclosure
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface...
CVE-2018-15125
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface...
DEF CON 2018: ‘Man in the Disk’ Attack Surface Affects All Android Phones
A function of the Android storage mechanism opens up an attack surface that affects all Android devices, and allows an attacker to corrupt data, steal sensitive information or even take control of a mobile phone. Simply put, the issue – dubbed “man in the disk” – allows a bad actor to hijack the...
DEBIAN-CVE-2017-2633
An out-of-bounds memory access issue was found in Quick Emulator QEMU before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vncrefreshserversurface'. A user inside a guest could use this flaw to crash the QEMU process...
Google Chrome - Swiftshader Blitting Floating-Point Precision Errors
getInternalFormat == FORMATNULL return; ifblitReactorsource, sourceRect, dest, destRect, options return; SliceRectF sRect = sourceRect; SliceRect dRect = destRect; bool flipX = destRect.x0 destRect.x1; bool flipY = destRect.y0 destRect.y1; ifflipX swapdRect.x0, dRect.x1; swapsRect.x0, sRect.x1;...
Intrigue-Core - Discover Your Attack Surface
Intrigue-core is a framework for automated attack surface discovery. There are a number of use cases: Application and Infrastructure Asset Discovery Security Research and Vulnerability Discovery Malware Campaign Research & Indicator Enrichment Exploratory OSINT Research If you'd like assistance...
science-et-surface.fr XSS vulnerability
Open Bug Bounty ID: OBB-637043 Description| Value ---|--- Affected Website:| science-et-surface.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Delay with touch screen swipe in HDX session from touch screen device when using Receiver for Windows
When using a touch screen device such as Microsoft surface pro which utilizes the full receiver for windows client users notice a delay when using the touch screen swipe feature in the session. This delay is most obvious when using the finger or a stylus pen to draw in an application such as MS...
Brave Software: Navigation to restricted origins via "Open in new tab"
Summary: It's possible to open links pointing to file:/// origin from web pages using "Open link in a new tab" in context menu. https://hackerone.com/bugs?reportid=369185 shows unsafe ssh:// protocol handling, which leads to information leak using sshOS username and etc.. The vulnerability is...
SingTel Backdoor Detection (ForgotDoor)
The remote SingTel router may be contain a backdoor. Certain SingTel routers had their administrative web interfaces port-forwarded to public-facing addresses by customer support after users requested customer service. Depending on the configuration, the router may require no credentials, default...
KB4073065: Surface guidance to protect against silicon-based microarchitectural and speculative execution side-channel vulnerabilities
None None...
KLA11030 Speculative Store Bypass and Rogue System Register Read vulnerabilities in Microsoft Surface Products
On January 3, 2018, Microsoft released advisories and security updates related to a recently discovered class of hardware vulnerabilities known as Spectre and Meltdown that affect AMD, ARM, and Intel CPUs. On May 21, 2018, Intel announced the Rogue System Registry Read vulnerability. Also a new...
Multiple CPU Hardware CVE-2018-3639 Information Disclosure Vulnerability
Description Multiple CPU Hardware are prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected ARM Cortex A15 ARM Cortex A57 ARM Cortex A72 IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 IBM Aix...
Foxit PDF Reader JavaScript setPersistent Remote Code Execution Vulnerability(CVE-2018-3842)
Summary An exploitable use of an uninitialized pointer vulnerability exists in the JavaScript engine in Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can lead to a dereference of an uninitialized pointer which, if under attacker control, can result in arbitrary code...
Building a world without passwords
Nobody likes passwords. They are inconvenient, insecure, and expensive. In fact, we dislike them so much that weve been busy at work trying to create a world without them a world without passwords. In this blog, we will provide a brief insight into how we at Microsoft think about solving this...