795 matches found
Design/Logic Flaw
Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software for Windows 7 and later" Ver3.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software for Windows Vista", The Public Certification...
CVE-2017-2157
The CVE-2017-2157 entry targets The Public Certification Service for Individuals “The JPKI user’s software” installers (Windows 7+, Vista, Ver2.6 and earlier). The root cause is an insecure DLL search path in the installer, leading to untrusted search path vulnerability and potential remote privi...
CVE-2017-2157
Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software for Windows 7 and later" Ver3.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software for Windows Vista", The Public Certification...
Android Permissions Flaw Will Linger Until O Release
Google said Tuesday that a permissions flaw that puts Android users at a heightened risk for malware, ransomware and adware attacks will not be fixed until the release of its next mobile OS, Android O. The vulnerability impacts an undisclosed number of apps hosted on Google Play, researchers at...
Security update for the Windows win32k Information Disclosure Vulnerability in Windows Server 2008: May 9, 2017
Security update for the Windows win32k Information Disclosure Vulnerability in Windows Server 2008: May 9, 2017 Summary An information disclosure vulnerability exists when the win32k component incorrectly provides kernel information. An attacker who successfully exploits the vulnerability could...
JVN#39605485: The installer of The Public Certification Service for Individuals "The JPKI user's software" may insecurely load Dynamic Link Libraries
The installer of The Public Certification Service for Individuals "The JPKI user's software" provided by Japan Agency for Local Authority Information Systems J-LIS contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Impact Arbitrary code may be...
CVE-2016-8924
IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...
DEBIAN-CVE-2016-10318
A missing authorization check in the fscryptprocesspolicy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of...
Internet Explorer Information Disclosure Vulnerability
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer. In a web-based attack scenario, an attacker could host a website used to attempt to exploit the...
CVE-2017-5832
Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...
X (Formerly Twitter): [URGENT] Opportunity to publish tweets on any twitters account
The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user. By sharing media with a victim user and then modifying the post request with the victim's account ID the media in question would be posted from the victim's account. This...
HP Helion Eucalyptus Multiple Vulnerabilities
HP Helion Eucalyptus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eucalyptus:eucalyptus"...
Mozilla Firefox < 50.1 Multiple Vulnerabilities
Binary data 9851.prm...
JVN#05493467: Simple keitai chat vulnerable to cross-site scripting
Simple keitai chat provided by LEMON-S PHP contains reflected and stored cross-site scripting vulnerabilities CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Do not use Simple keitai chat Simple keitai chat is no longer being developed or maintained. It is...
Open Type Font Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Adobe Type Manager Font Driver improperly handles specially crafted OpenType fonts. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. There are multiple ways an attacke...
Microsoft Edge CVE-2016-7189 Scripting Engine Remote Code Execution Vulnerability
Description Microsoft Edge is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the affected...
CVE-2016-4715
The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via a crafted app...
Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC)
PS4 3.55 Unsigned Code Execution ============== This GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50 and 3.55. This Exploit, is based-off Henkaku's WebKit Vulnerability for the Sony's PSVita. It includes bas...
ZKTeco ZKAccess Security System 5.3.1 - Persistent Cross-Site Scripting
Exploit for jsp platform in category web applications !-- ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 5.3.12252 Summary: ZKAccess Systems ar...
Web Security testing common logic vulnerability analysis（combat article-the vulnerability warning-the black bar safety net
Logic vulnerabilities mining has always been Safety tested in the“timeless”topic. Compared toSQL injection, withXSSthe vulnerability of traditional security holes, and now the attacker is more inclined to use the business logic layer of the application security issues, such issues tend to harm th...