CVE-2018-13412

An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

CVE-2018-13411

An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

Information disclosure

An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

Beware! Unpatched Safari Browser Hack Lets Attackers Spoof URLs

A security researcher has discovered a serious vulnerability that could allow attackers to spoof website addresses in the Microsoft Edge web browser for Windows and Apple Safari for iOS. While Microsoft fixed the address bar URL spoofing vulnerability last month as part of its monthly security...

Mayan EDMS Cross-Site Scripting Vulnerability (CNVD-2019-09817)

Mayan EDMS is a document management system developed by software developer Roberto Rosario. The system supports electronic signatures, version control and optical character recognition. A cross-site scripting vulnerability exists in Mayan EDMS versions prior to 3.0.2. The vulnerability stems from...

PYSEC-2018-16

An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS...

PYSEC-2018-106

An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS...

ALPINE-CVE-2018-14600

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write of up to 128 bytes, leading to DoS or remote code execution...

UBUNTU-CVE-2018-14600

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write of up to 128 bytes, leading to DoS or remote code execution...

PT-2018-1984

Name of the Vulnerable Software and Affected Versions Astra Linux X Window System Xorg-server affected versions not specified Description The issue is related to the lack of restriction on the use of XungrabKeyboard and XgrabKeyboard functions for untrusted users, allowing the implementation of...

X.org libX11 Denial of Service Vulnerability (CNVD-2018-16966)

X.Org libX11 is an X11 X Window System client library run by the X.Org Foundation. A denial of service vulnerability exists in the 'XListExtensions' function of the ListExt.c file in X.Org libX11 1.6.5 and earlier versions. An attacker can exploit this vulnerability by sending a reply that causes...

Debian DLA-1469-1 : libxcursor security update

It was discovered that there was a denial of service or potentially code execution vulnerability in libxcursor, a library designed to help locate and load cursors for the X Window System. For Debian 8 'Jessie', this issue has been fixed in libxcursor version 1:1.1.14-1+deb8u2. We recommend that y...

August 14, 2018—KB4343909 (OS Build 17134.228)

None None...

VK.com: [Клевер/Android] Небезопасный BroadcastReceiver позволяет создавать окно диалога в приложении посредством другого неавторизованного приложения

Небезопасный BroadcastReceiver. morethEnvulnerability Click to view screenshot Когда приложение видно пользователю в MainActivity регистрируются два ресивера: java registerReceiverthis.r, new IntentFilter"com.vk.quiz.action"; registerReceiverthis.q, new IntentFilter"com.vk.quiz.action.coins";...

openSUSE Security Update : cinnamon (openSUSE-2018-767)

This update for cinnamon fixes the following issues : Security issue fixed : - CVE-2018-13054: Fix symlink attack vulnerability boo1083067. Bug fixes : - Update to version 3.4.6 changes since 3.4.4 : - osdWindow.js: Always check the theme node on first showing - an actor's width isn't necessarily...

Zero-Day Coverage Update – Week of July 23, 2018

We’re at the end of July and the Zero Day Initiative ZDI has published 873 advisories so far. That’s 273 advisories this month alone – and that’s just the tip of the iceberg! Earlier this week, ZDI announced the Targeted Incentive Program, which brings over $1,500,000 USD in special bounty awards...

AZL-41702 CVE-2017-7526 affecting package grub2 for versions less than 2.06-25

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This...

CVE-2017-7526

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This...

CVE-2017-7526: Exposure of Sensitive Information to an Unauthorized Actor

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This...

PT-2018-2901

Name of the Vulnerable Software and Affected Versions Secret Net Studio affected versions not specified Description The issue is related to the Window Filtering Platform port mechanism of the SNPAVdrv driver in the Secret Net Studio information protection system. It is caused by the lack of prope...