CVE-2017-16611

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open but not read files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files...

CVE-2017-8210

The CVE-2017-8210 entry concerns a buffer overflow in the driver of Huawei Honor 5C and Honor 6X smartphones. Affected software versions are earlier than NEM-AL10C00B356 and earlier than Berlin-L21HNC432B360. The root cause is lack of parameter validation in the driver, enabling an attacker to tr...

Repo password on display for the world to see.

I just noticed that my machine user name and password are on display above the commit dialog. Since this job site uses single sign on for everything, that's my username and password for the entire system here. I have three different repos loaded in Sourcetree. Because of single sign on, that is...

Login Bypass Vulnerability in Xinhuo Collaboration Platform

Xinhuo coworking system is an open source office system, cross-platform system, support APP, pc web version, pc client and so on. Xinhao Collaboration Office platform there is a login bypass vulnerability , attackers can use the vulnerability to bypass authentication , successfully logging into t...

Google Android System Elevation of Privilege Vulnerability

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in System for Google Android 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0, which can be exploited by attackers to gain elevation ...

KLA11130 Denial of service vulnerability in Google Chrome

An unspecified vulnerability in the V8 component that allows the stack-based buffer to overflow stack buffer overflow. This vulnerability can be exploited remotely by an unauthenticated attacker to execute arbitrary code and to cause denial of service; Technical details NB: This vulnerability doe...

GHSA-RPRJ-G6XC-P5GQ Wicked gem contains Path traversal vulnerability

The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in controller/concerns/renderredirect.rb. An attacker can send a specially-crafted URL request containing %2E%2E%2F directory traversal sequences to read arbitrary files on the system...

Wicked gem contains Path traversal vulnerability

The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in controller/concerns/renderredirect.rb. An attacker can send a specially-crafted URL request containing %2E%2E%2F directory traversal sequences to read arbitrary files on the system...

Fileless Malware: A Hidden Threat

Malware is advancing at an unprecedented rate, with four new strains discovered every minute, Slate reported. This is already a lot for businesses to worry about and it doesn't even cover the other threats that haven't been detected. Many attackers have evolved their techniques to evade common...

Directory Traversal and Arbitrary Password Reset Vulnerabilities in ourphp

OURPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. OURPHP has directory traversal and arbitrary password reset vulnerabilities, which can be exploited by attackers to obtain sensitive information, perform unauthorized...

Unspecified Vulnerability in Oracle Advanced Outbound Telephony (CNVD-2017-30897)

Oracle E-Business Suite E-Business Suite is a set of Oracle's fully integrated global business management software. Oracle Advanced Outbound Telephony is one of the tools used for outbound call campaign list management and predictive dialing. An unspecified vulnerability exists in the Setup and...

The vulnerability of the Arbor Peakflow SP traffic control analysis system lies in the lack of protection for operational data, allowing intruders to read arbitrary files.

The vulnerability of the Arbor Peakflow SP traffic control analysis system is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

Netgear ReadyNAS Surveillance 1.4.3-16 Remote Command Execution Vulnerability

Netgear ReadyNAS Surveillance version 1.4.3-16 suffers from a remote command execution vulnerability. Exploit Netgear ReadyNAS Surveillance 1.4.3-16 Unauthenticated RCE Software Link: https://www.netgear.com/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website:...

Millions of Up-to-Date Apple Macs Remain Vulnerable to EFI Firmware Hacks

"Always keep your operating system and software up-to-date." This is one of the most popular and critical advice that every security expert strongly suggests you to follow to prevent yourself from major cyber attacks. However, even if you attempt to install every damn software update that lands t...

EUVD-2017-1139

A information disclosure vulnerability in the Android system bluetooth. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146698...

Unauthorized Operation Vulnerability in Digital Orientation Management System of New Cape Electronics Co.

Digital Orientation Management System is a student system solution. An unauthorized operation vulnerability exists in the Digital Orientation Management System DOMS of Xin Kaipu Electronics Co. The vulnerability is caused by the failure to validate the background parameters of the website, which...

Unpatchable Flaw in Modern Cars Allows Hackers to Disable Safety Features

Today, many automobiles companies are offering vehicles that run on the mostly drive-by-wire system, which means a majority of car's functions—from instrument cluster to steering, brakes, and accelerator—are electronically controlled. No doubt these auto-control systems make your driving experien...

Microsoft Graphics Component Information Disclosure (CVE-2017-0283)

An information disclosure vulnerability exists in Microsoft Graphics Component. The vulnerability is due to improper handling of objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization ASLR bypass. An attacker could convince a user ...

SQL injection vulnerability in 114La web site navigation building system

114La Web site navigation building system is a Web site navigation service. A SQL injection vulnerability exists in the 114La website navigation system. An attacker can exploit this vulnerability to obtain database information...

The vulnerability of the Windows operating system’s kernel driver mode allows attackers to escalate their privileges.

The vulnerability of the Windows operating system’s kernel mode driver is related to improper data handling. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges...