samba: SMB2 connections don't keep encryption across DFS redirects

A flaw was found in the way samba client used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack...

CVE-2017-9645

An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants including RSD31-AM Package, DRM-1/2 and variants including Solar PWR Package, DRM and RDS Based Boundary Monitors, External Transmitters,...

The vulnerability of the PostgreSQL database management system, related to deficiencies in the authentication process, allows attackers to gain access to the database account.

The vulnerability of the PostgreSQL database management system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain access to the database account with an empty password...

The vulnerability of component mm.c (arch/x86/mm.c) in the Xen hypervisor and the XenServer server virtualization platform allows a perpetrator to increase their privileges.

The vulnerability of component mm.c arch/x86/mm.c in the Xen hypervisor and the XenServer server virtualization platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating locally, to enhance their privileges by using functions related t...

The vulnerability of the Surveillance Station network storage component on QNAP TS212P allows a intruder to gain unauthorized access to the device and execute arbitrary commands.

The vulnerability of the Surveillance Station network storage component of QNAP TS212P is related to deficiencies in access control for device functions. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to the device and execute arbitrary commands...

RubyGems < 2.6.13 - Arbitrary File Overwrite

There is no check for name field in metadata.gz. By assigning a maliciously crafted string like ../../../../../any/where to the field, an attacker can create an arbitrary file out of the directory of the gem, or even replace an existing file with a malicious file. Proof of Concept 1: Create a fil...

The vulnerability of the audio driver of the mobile application MSM for the Android operating system allows a hacker to trigger a stack overflow.

The vulnerability of the Android mobile application’s audio driver relates to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to select certain values in the user’s environment, which may lead to stack overflow...

The vulnerability of the Android operating system from the CAF repository exists due to insufficiently robust data encryption. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Android operating system from the CAF repository is related to insufficiently robust data encryption. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information, as insecure algorithms we...

The vulnerability of the I2C operating system in Android CAF-releases allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the I2C interface in the Android CAF-fixes operating system is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Android operating system from the CAF repository exists due to deficiencies in access control to the file system. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Linux operating system Android from the CAF repository is related to deficiencies in access control to the file system. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

Kaspersky Internet Security for Android Security Bypass Vulnerability

Kaspersky Internet Security for Android is a set of security software based on the Android platform developed by the Russian Kaspersky Lab Kaspersky Lab with both antivirus and firewall functions. A security vulnerability exists in version 11.12.4.1622 of Kaspersky Internet Security for Android,...

PYSEC-2017-66

The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...

Vulnerability in the MPEG-2 decoder of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability in the MPEG-2 decoder of the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the update mechanism for dynamic JAR files used in cloud service development tools like Context Service Software Development Kit allows a perpetrator to execute arbitrary code.

The vulnerability of the mechanism for updating dynamic JAR files used in cloud service development tools like Context Service Software Development Kit exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the...

CVE-2017-1501

IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the web services security bindings settings. IBM X-Force ID: 129576...

CVE-2017-1501

CVE-2017-1501 affects IBM WebSphere Application Server; the Admin Console could leave web services security bindings weaker after updates. IBM bulletins indicate affected WAS versions include 8.0, 8.5, and 9.0 lines (e.g., 9.0.0.0–9.0.0.4; 8.5.5.10/11; 8.0.0.13). The vulnerability score via CVSSv...

The vulnerability of the Autonomic Networking component in Cisco IOS and Cisco IOS XE operating systems allows a attacker to trigger a service failure.

The vulnerability of the Autonomic Networking component in Cisco IOS and Cisco IOS XE operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to trigger a service failure rebooting of autonomous system nodes...

Apple iOS v10.3 - UI SMS Access Permission Vulnerability

Document Title: =============== Apple iOS v10.3 - UI SMS Access Permission Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2079 Video: https://www.youtube.com/watch?v=jePRogkoon8 Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2078...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration Exploit

Exploit for jsp platform in category web applications !/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 buil...

DALIM SOFTWARE ES Core 5.0 Build 7184.1 User Enumeration

!/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 build 7114.1 build 7114.0 build 7093.1 build 7093.0 build...