The vulnerability of the Mac OS X operating system allows a hacker to execute arbitrary code in a privileged context.

The vulnerability of the Apple Type Services component of the Mac OS X operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context using a specially created application...

ABB PCM600 Password Hash Vulnerability

The ABB PCM600 is a protection and control IED manager, primarily used in the energy industry. The master application password in the ABB PCM600 ACTConfig configuration file uses a weak hash function. A local attacker could exploit this vulnerability to access the affected device...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the dxgkrnl.sys sub-component of the DirectX graphics kernel in Windows operating systems is related to access control deficiencies. Exploiting this vulnerability allows a local attacker to enhance their privileges through a specially created application...

CVE-2016-2855

The Huawei Mobile Broadband HL Service 22.001.25.00.03 and earlier uses a weak ACL for the MobileBrServ program data directory, which allows local users to gain SYSTEM privileges by modifying VERSION.dll...

The vulnerabilities of PDF viewer programs such as Adobe Reader, Adobe Reader Document Cloud, and PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat allow attackers to circumvent restrictions imposed by JavaScript APIs.

The vulnerabilities of PDF viewer programs such as Adobe Reader, Adobe Reader Document Cloud, and PDF editing programs like Adobe Acrobat Document Cloud are related to lack of access control mechanisms. Exploiting these vulnerabilities can allow a malicious actor to bypass restrictions on the...

USN-2973-1 thunderbird vulnerabilities

Christian Holler, Tyson Smith, and Phil Ringalda discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code...

Botan weak encryption vulnerability

Botan is a C++ library of cryptographic algorithms that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A weak cryptographic vulnerability in the Miller-Rabin prime test in Botan versions prior to 1.10.8 and 1.11.x prior to 1.11.9 stems from the program failing to properly use a single...

The vulnerability of the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the Qualcomm TrustZone-based Android operating system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to enhance their privileges through a specially created application...

The vulnerability of the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the Qualcomm TrustZone-based Android operating system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to enhance their privileges through a specially created application...

Amazon Linux: Security Advisory (ALAS-2016-694)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945)

It was discovered that the GCM Galois/Counter Mode implementation in the JCE component in OpenJDK used a non-constant time comparison when comparing GCM authentication tags. A remote attacker could possibly use this flaw to determine the value of the authentication tag...

OpenSSH < 6.9 Multiple Vulnerabilities

Binary data 9308.prm...

OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected...

UBUNTU-CVE-2015-8842

tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file...

URL Shorteners Put Private Cloud Data at Risk

URL shorteners are convenient, but for a long time gave security practitioners anxiety because it was difficult to determine where the shortened address was taking you. Two researchers have now given you new reasons to fear URL shorteners, especially for those storing and sharing data on...

The vulnerability of the Silverlight software platform, which allows a hacker to bypass the ASLR protection mechanism

The vulnerability of the Silverlight software platform is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass the ASLR protection mechanism by using a specially crafted web page...

Code injection

Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified 1 services and 2 files, which allows local users to gain privileges by invalidating local checks...

Linux Kernel (x86) - Disable ASLR by Setting the RLIMIT_STACK Resource to Unlimited

Linux Kernel x86 - Disable ASLR by Setting the RLIMITSTACK Resource to Unlimited Source: http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-disables-ASLR.html CVE-2016-3672 - Unlimiting the stack not longer disables ASLR Authors: Hector Marco & Ismael Ripoll CVE: CVE-2016-3672...

UBUNTU-CVE-2016-3125

The modtls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman DH key to be used and consequently allow attackers to have unspecified impact via unknown vectors...

The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to gain access to protected information

The vulnerability of the Universal Worklist Configuration component of the SAP NetWeaver software integration platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information through a...