SUSE-SU-2017:3025-1 Security update for xorg-x11-server

This update for xorg-x11-server provides several fixes. These security issues were fixed: - CVE-2017-13723: Prevent local DoS via unusual characters in XkbAtomText and XkbStringText bsc1051150. - Improve the entropy when generating random data used in X.org server authorization cookies generation...

CVE-2017-14025

An Improper Input Validation issue was discovered in ABB FOX515T release 1.0. An improper input validation vulnerability has been identified, allowing a local attacker to provide a malicious parameter to the script that is not validated by the application, This could enable the attacker to retrie...

Lenovo Service Framework Android Remote Code Execution Vulnerability

Lenovo Service Framework Android application is a special application for Lenovo products based on the Android platform from China Lenovo Lenovo Company. A security vulnerability exists in the Lenovo Service Framework Android application, which originates from the program failing to properly...

Design/Logic Flaw

When aprtimeexp or aprosexptime functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an aprtimeexpt value, potentially revealing the contents of a different static heap value or...

NVIDIA GeForce Experience Installer Framework Elevation of Privilege Vulnerability

NVIDIA GeForce Experience GFE is a suite of automatic graphics card updating tools from NVIDIA.The NVIDIA Installer Framework is one of the installation frameworks.... An elevation of privilege vulnerability exists in NVISystemService64 of the NVIDIA Installer Framework in version 3.x prior to...

CVE-2017-15583

The embedded web server on ABB Fox515T 1.0 devices is vulnerable to Local File Inclusion. It accepts a parameter that specifies a file for display or for use as a template. The filename is not validated; an attacker could retrieve any file...

PT-2017-14114 · Abb · Abb Fox515T

Name of the Vulnerable Software and Affected Versions: ABB Fox515T version 1.0 Description: The embedded web server is vulnerable to Local File Inclusion. It accepts a parameter that specifies a file for display or for use as a template. The filename is not validated, allowing an attacker to...

CVE-2017-11062

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently attributes are not validated in wlanhddcfg80211doacs which can potentially lead to a buffer overread...

Qmail SMTP - Bash Environment Variable Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Qmail SMTP Bash Environment Variable Injection Shellshock', 'Description' = %q This module exploits a shellshock vulnerability on Qmail, a public...

UBUNTU-CVE-2017-14977

The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack...

SAP Enterprise Portal Cross-Site Scripting Vulnerability

SAP Enterprise Portal is a set of enterprise portal based on NetWeaver system platform developed by SAP, which contains content management, single sign-on, knowledge management, collaborative work, full-text search and other modules. A cross-site scripting vulnerability exists in SAP Enterprise...

DEBIAN-CVE-2017-6272

NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used as the index to an array which may lead to a denial of service or possible escalation of privileges...

UBUNTU-CVE-2017-6272

NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used as the index to an array which may lead to a denial of service or possible escalation of privileges...

Adobe RoboHelp Multiple Vulnerabilities (APSB17-25)

The version of Adobe RoboHelp installed on the remote Windows host is affected by multiple vulnerabilities, including a cross-site scripting XSS vulnerability as well as an unvalidated URL redirect vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid103221;...

CVE-2017-8714

The Windows Hyper-V component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2,, Windows 10 1607, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Remote Desktop...

EE 4GEE WiFi MBB Cross-Site Scripting Vulnerability

The EE 4GEE WiFi MBB is a mobile wireless router device from EE UK. A cross-site scripting vulnerability exists in versions prior to EE 4GEE WiFi MBB EE600005.0031, which stems from a lack of input validation or encryption in the program. A remote attacker can exploit the vulnerability to inject...

CVE-2017-14344

This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL...

Default credentials

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...

APSB17-25 Security update available for RoboHelp

Adobe has released a security update for RoboHelp for Windows. This update resolves an important input validation vulnerability that could be used in a cross-site scripting attack CVE-2017-3104, as well as an unvalidated URL redirect vulnerability rated moderate that could be used in phishing...

Apache Struts2 REST plugin remote code execution vulnerability

Struts2 is the Apache Software Foundation is responsible for maintaining a MVC-based design pattern of the Web application framework for open source projects . Apache Struts2 REST plugin has a remote code execution vulnerability , due to the use of XStream component on the XML format of the packe...