CVE-2017-0243

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8570...

CVE-2017-8570

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka “Microsoft Office Remote Code Execution Vulnerability”. This CVE ID is unique from CVE-2017-0243. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed...

An Assassin's Teapot

This teapot has two chambers. Liquid is released from one or the other depending on whether an air hole is covered. I want one...

unique-milano.com XSS vulnerability

Vulnerable URL: http://www.unique-milano.com/collezioni.php?marchio=1"...

Starbucks: Possible subdomain takeover at openapi.starbucks.com

@benoculars was able to take advantage of a process flaw to use some of the space provided for openapi.starbucks.com. While we were still securely serving content from this domain and it did not impact users or operations, it would have been possible for @benoculars to serve content from unique...

CVE-2017-0288

Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Windows Graphics Information Disclosure Vulnerability". This...

Information disclosure

Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique fr...

Serendipity < 2.1.1 Multiple Vulnerabilities

According to its banner, the version of Serendipity running on the remote host is prior to 2.1.1. It is, therefore, affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists in the templates/2k11/admin/category.inc.tpl script due to improper validation of the...

BOSH Director VM Agent Anonymous Endpoint Vulnerability

BOSH is an open source tool for deployment and lifecycle management of large-scale distributed systems, of which Director VM is a virtual machine and stemcell is an image. A security vulnerability exists in the endpoint of the Agent in the BOSH Director VM using stemcell versions prior to 3232.6...

KDE kauth and kdelibs Logic Flaw Lets Local Users Obtain Root Privileges(CVE-2017-8422)

This document describes a generic root exploit against kde. The exploit is achieved by abusing a logic flaw within the KAuth framework which is present in kde4 org.kde.auth and kde5 org.kde.kf5auth. It is possible to spoof what KAuth calls callerID's which are indeed D-Bus unique names of the...

CVE-2017-9030

The Codextrous B2J Contact aka b2jcontact extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid protection mechanism, and makes it easier to read arbitrary uploaded files...

CVE-2017-0213

Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a speciall...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...

The vulnerability of the iOS operating system, which allows a hacker to read data from the swap buffer

The vulnerability of the Pasteboard component in the iOS operating system is related to errors in managing cryptographic keys. Exploiting this vulnerability allows a local attacker to read data from the swap buffer using the encryption key obtained from the hardware UID...

Fedora 24 : tcpreplay (2017-7980b5e846)

Here is what is fixed in this release : - Fix reporting of rates 1Mbps 348 - Option --unique-ip not working properly 346 ---- Features and fixes include : - MAC rewriting capabilities by Pedro Arthur 313 - Fix several issues identified by Coverity 305 - Packet distortion --fuzz-seed option by...

CVE-2017-2399

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Pasteboard" component. It allows physically proximate attackers to read the pasteboard by leveraging the use of an encryption key derived only from the hardware UID rather than that UID in...

ICSMA-17-082-01_BD Kiestra PerformA and KLA Journal Service Applications Hard-Coded Passwords Vulnerability

OVERVIEW Becton, Dickinson and Company BD has identified a hard-coded password vulnerability in BD’s Kiestra PerformA and KLA Journal Service applications that access the BD Kiestra Database. BD has produced compensating controls to reduce the risk of exploitation of the identified vulnerability ...

Spora Ransomware Offers Unique Payment Options

Researchers are keeping close tabs on a new ransomware strain called Spora that offers victims unique payment options and comes with top-notch encryption. Spora was spotted last week by ransomware experts at BleepingComputer, who said after Spora encrypts files on your computer, it offers four...

SQL Injection Vulnerability in the uuid Parameter of Shenzhen Siquan CRM System

Ltd. is engaged in OA, CRM, ERP, HRM, enterprise mailbox system consulting and services. SQL injection vulnerability exists in the uuid parameter of the Shenzhen SiQuan CRM system. Allows attackers to exploit the vulnerability to obtain sensitive database information...

‘Popcorn Time’ Ransomware Sure to Cause Indigestion

ARCHIVED STORY ‘Popcorn Time’ Ransomware Sure to Cause Indigestion By Tim Hux · December 19, 2016 In early December the new ransomware “Popcorn Time” was discovered. It gives the victim the option of paying the ransom or infecting two other individuals and getting them to pay. “Popcorn Time” is a...