Code injection

The TLS implementation in the TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 58.1 before 58.160, 59.1 before 059.1a.17 IC 17, and 60.0 before 60.044 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT...

CVE-2018-5762

Unisys ClearPath MCP TCP/IP networking module TLS implementation is vulnerable to a Bleichenbacher RSA padding oracle (ROBOT) leading to possible decryption of TLS ciphertext. Affected versions are TCP-IP-SW 58.1 before 58.160, 59.1 before 059.1a.17 (IC #17), and 60.0 before 60.044. The CNVD entr...

Shopware 5.2.5/5.3 - Cross-Site Scripting

Document Title: =============== Shopware 5.2.5 & v5.3 - Multiple Cross Site Scripting Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1922 Shopware Security Tracking ID: SW-19834 Security Update:...

CVE-2017-14797

The CVE-2017-14797 entry concerns Philips Hue Bridge BSB002 public API on firmware 1707040932, where a lack of transport encryption enables an attacker on the local intranet to sniff HTTP traffic and read API keys. This bypasses the pushlink protection and can, per cited sources, allow full contr...

sw-marine.com XSS vulnerability

Vulnerable URL: http://www.sw-marine.com/galleries/rigging/svcore/full.html?bg=xss"=http%3A%2F%2Fwww.sw-marine.com%2Fgalleries%2Frigging%2Fgallery.xml Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

Security Advisory 0029

Security Advisory 0029 PDF Date: May 15th, 2017 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | May 15th, 2017 | Initial release Affected Platforms: All EOS platforms Affected Software Version: All EOS releases prior to 4.18.1F. The list of affected releases is documented in Table-2. The...

Samsung SW Update Service Privilege Escalation Vulnerability

Samsung Software Update Service, SWUpdateService SWMAgent.exe, installs as a service with an unquoted service path running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. Exploit...

Samsung SW Update Service Privilege Escalation

Exploit Title: Samsung SW Update Service Unquoted Service Path Privilege Escalation Date: 04/10/2016 Author: Yunus YILDIRIM Th3GundY Team: CT-Zer0 @CRYPTTECH && Superbug @xsuperbug Website: http://yildirimyunus.com Contact: [email protected] Category: local Vendor Homepage:...

Apache MyFaces Trinidad CVE-2016-5019 Remote Code Execution Vulnerability

Description Apache MyFaces Trinidad is prone to a security vulnerability. Successfully exploiting this issue allows attackers to obtain sensitive information or execute arbitrary code in the context of the affected application. Apache MyFaces Trinidad 1.2.14-core , 1.0.13-core , 2.0.1-core and...

Samsung SW Update Software Local Elevation of Privilege Vulnerability

Samsung SW Update Software formerly known as Samsung Easy Software Manager is a suite of software for updating BIOS, drivers, etc. over the network from Samsung South Korea. A local elevation of privilege vulnerability exists in Samsung SW Update Software version 2.2.7.22 and earlier. A local...

Samsung SW Update 2.2.7.22 Insecure ACLs

Blue Frost Security GmbH https://www.bluefrostsecurity.de/ researchatbluefrostsecurity.de BFS-SA-2016-002 25-April-2016 Vendor: Samsung, www.samsung.com Affected Products: SW Update Affected Version: cacls "c:\Programdata\Samsung\SW...

SW Battlefront Companion - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application SW Battlefront Companion published at the 'play' market has multiple vulnerabilities...

Android One - mt_wifi IOCTL_GET_STRUCT Privilege Escalation

Android One - mtwifi IOCTLGETSTRUCT Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=678 The wireless driver for the Android One sprout devices has a bad copyfromuser in the handling for the wireless driver socket private read ioctl IOCTLGETSTRUCT with...

Samsung Windows Laptop Owners Urged To Download Fix To MitM Vulnerability

Samsung laptop owners are being urged to update their Windows PCs after the discovery of a vulnerability that can allow remote attackers to download files onto a targeted system and gain complete control over the laptop. The flaw is tied to a feature called “Samsung SW Update Tool 2.2.5.16”...

update.carlsonsw.com XSS vulnerability

Vulnerable URL: http://update.carlsonsw.com/serialupgradelookup.php?prodname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 15:50 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

Samsung to Patch Windows Update Issue Within Days

Samsung said today it will no longer automatically disable Windows updates on PCs and laptops it manufactures and will release a patch “within a few days.” The practice was outed this week by a 22-year-old Microsoft MVP named Patrick Barker who posted a report to his personal website the explaine...

Samsung PC malicious disable the Windows Update“scandal”-vulnerability warning-the black bar safety net

The recent Windows users reflect that their Samsung computer on the Windows Automatic Update program will be randomly disabled, this is for their PC Security a security risk. 禁用 Windows 更新 的 程序 名为 DisableWindowsupdate.exe this app is Samsung SW Update software part. SW Update is typical for the O...

Samsung Disables Windows Update

Samsung PC owners could soon find themselves in an endless carousel of enabling Windows Update with each reboot of their machine after a computing enthusiast discovered that a Samsung feature disables Microsoft’s update mechanism by default. Windows Update is a service that delivers, among other...

New-CMS - Multiple Vulnerability

No description provided by source. Multiple Vulnerability in New-CMS Vendor SW: New-CMS Version: 1.08 but possible all versions Vendor URL: www.new-cms.org Tested on: Ubuntu Server 9.10 Category: Webapps/0day Date: 17 Feb 2010 Author: Alberto fulgur Fontanella Author URL: ictsec.wordpress.com...

VulnCheck KEV: CVE-2013-2094

Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perfsweventenabled array in swperfeventdestroy. Explotation allows for privilege escalation...