Information disclosure

An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

Beware! Unpatched Safari Browser Hack Lets Attackers Spoof URLs

A security researcher has discovered a serious vulnerability that could allow attackers to spoof website addresses in the Microsoft Edge web browser for Windows and Apple Safari for iOS. While Microsoft fixed the address bar URL spoofing vulnerability last month as part of its monthly security...

Mayan EDMS Cross-Site Scripting Vulnerability (CNVD-2019-09817)

Mayan EDMS is a document management system developed by software developer Roberto Rosario. The system supports electronic signatures, version control and optical character recognition. A cross-site scripting vulnerability exists in Mayan EDMS versions prior to 3.0.2. The vulnerability stems from...

PYSEC-2018-106

An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS...

PYSEC-2018-16

An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS...

ALPINE-CVE-2018-14600

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write of up to 128 bytes, leading to DoS or remote code execution...

UBUNTU-CVE-2018-14600

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write of up to 128 bytes, leading to DoS or remote code execution...

X.org libX11 Denial of Service Vulnerability (CNVD-2018-16966)

X.Org libX11 is an X11 X Window System client library run by the X.Org Foundation. A denial of service vulnerability exists in the 'XListExtensions' function of the ListExt.c file in X.Org libX11 1.6.5 and earlier versions. An attacker can exploit this vulnerability by sending a reply that causes...

Debian DLA-1469-1 : libxcursor security update

It was discovered that there was a denial of service or potentially code execution vulnerability in libxcursor, a library designed to help locate and load cursors for the X Window System. For Debian 8 'Jessie', this issue has been fixed in libxcursor version 1:1.1.14-1+deb8u2. We recommend that y...

August 14, 2018—KB4343909 (OS Build 17134.228)

None None...

VK.com: [Клевер/Android] Небезопасный BroadcastReceiver позволяет создавать окно диалога в приложении посредством другого неавторизованного приложения

Небезопасный BroadcastReceiver. morethEnvulnerability Click to view screenshot Когда приложение видно пользователю в MainActivity регистрируются два ресивера: java registerReceiverthis.r, new IntentFilter"com.vk.quiz.action"; registerReceiverthis.q, new IntentFilter"com.vk.quiz.action.coins";...

openSUSE Security Update : cinnamon (openSUSE-2018-767)

This update for cinnamon fixes the following issues : Security issue fixed : - CVE-2018-13054: Fix symlink attack vulnerability boo1083067. Bug fixes : - Update to version 3.4.6 changes since 3.4.4 : - osdWindow.js: Always check the theme node on first showing - an actor's width isn't necessarily...

Zero-Day Coverage Update – Week of July 23, 2018

We’re at the end of July and the Zero Day Initiative ZDI has published 873 advisories so far. That’s 273 advisories this month alone – and that’s just the tip of the iceberg! Earlier this week, ZDI announced the Targeted Incentive Program, which brings over $1,500,000 USD in special bounty awards...

AZL-41702 CVE-2017-7526 affecting package grub2 for versions less than 2.06-25

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This...

Microsoft Windows Child Window NULL Pointer Dereference Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

kernel: Divide-by-zero in __tcp_select_window

A divide-by-zero vulnerability was found in the tcpselectwindow function in the Linux kernel. This can result in a kernel panic causing a local denial of service...

Security Bulletin: Information disclosure of stack trace in browser window in WebSphere Application Server LIBERTY affect IBM Spectrum LSF Application Center

Summary Information disclosure of stack trace in browser window in WebSphere Application Server LIBERTY Vulnerability Details CVEID: CVE-2018-1553 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptio...

OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with...

GNOME Web Denial of Service Vulnerability (CNVD-2018-11431)

GNOME Web Epiphany is a browser product for the GNOME desktop. The product provides paging, cookie management, pop-up ad control, and other features. A security vulnerability exists in the libephymain.so file in GNOME Web 3.28.2.1 and earlier versions. A remote attacker can exploit this...

CVE-2017-7801

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox...