Zero-day vulnerability in Telegram

In October 2017, we learned of a vulnerability in Telegram Messenger's Windows client that was being exploited in the wild. It involves the use of a classic right-to-left override attack when a user sends files over the messenger service. Right-to-left override in a nutshell The special nonprinti...

Automattic: [Simplenote for Windows] Client RCE via External JavaScript Inclusion leveraging Electron

Hi, A carefully crafted injection in the Markdown parser within Simplenote for Windows can be leveraged to achieve remote code execution via an external JavaScript file. The nature of Simplenote's content sharing system, which makes use of tags containing email addresses, means that an adversary...

Perfect Privacy VPN Manager v1.10.11 - DoS Vulnerability

Document Title: =============== Perfect Privacy VPN Manager v1.10.11 - DoS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2102 Ticket:...

CVE-2017-12284

A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profile information, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input- and validation-checking mechanism...

Design/Logic Flaw

A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profile information, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input- and validation-checking mechanism...

CVE-2017-12284

A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profile information, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input- and validation-checking mechanism...

CVE-2017-12284

The CVE-2017-12284 issue affects Cisco Jabber for Windows Client (web interface). Affected component: the web interface of Cisco Jabber for Windows. Root cause: insufficient input and validation checks that allow an authenticated, local attacker to issue commands and view profile information beyo...

Cisco Jabber for Windows Client Information Disclosure Vulnerability

A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profile information, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input- and validation-checking mechanism...

Vulnerability in TPM could allow Security Feature Bypass

Executive Summary This advisory addresses CVE-2017-15361, also referred to as "Return of Coppersmith's Attack" ROCA. A security vulnerability exists in certain Trusted Platform Module TPM chipsets. The vulnerability weakens key strength. It is important to note that this is a firmware...

Microsoft Office Groove - Workspace Shortcut Arbitrary Code Execution

Microsoft Office Groove - Workspace Shortcut Arbitrary Code Execution Title: MS Office Groove 'Workspace Shortcut' Arbitrary Code Execution Vulnerability Date: September 28th, 2017. Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: https://products.office.com/...

TeamSpeak Server Buffer Overflow Vulnerability

TeamSpeak Serve is a voice over IP communication system server designed specifically for online gamers. A buffer overflow vulnerability exists in TeamSpeak Server version 3.0.13.6 08/11/2016 09:48:33. An attacker can exploit this vulnerability to cause a denial of service WINDOWS client crash...

Buffer overflow

A potential Buffer Overflow Vulnerability from a BB Code handling issue has been identified in TeamSpeak Server version 3.0.13.6 08/11/2016 09:48:33, it enables the users to Crash any WINDOWS Client that clicked into a Vulnerable Channel of a TeamSpeak Server...

CVE-2017-8290

A potential Buffer Overflow Vulnerability from a BB Code handling issue has been identified in TeamSpeak Server version 3.0.13.6 08/11/2016 09:48:33, it enables the users to Crash any WINDOWS Client that clicked into a Vulnerable Channel of a TeamSpeak Server...

CVE-2017-8290

A potential Buffer Overflow Vulnerability from a BB Code handling issue has been identified in TeamSpeak Server version 3.0.13.6 08/11/2016 09:48:33, it enables the users to Crash any WINDOWS Client that clicked into a Vulnerable Channel of a TeamSpeak Server...

CVE-2017-8290

A potential Buffer Overflow Vulnerability from a BB Code handling issue has been identified in TeamSpeak Server version 3.0.13.6 08/11/2016 09:48:33, it enables the users to Crash any WINDOWS Client that clicked into a Vulnerable Channel of a TeamSpeak Server...

Information disclosure

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka...

Kerio Connect and Kerio Connect Client for Windows and Mac Clickjacking Vulnerability

Kerio Connect is a professional mail mail server setup software.Kerio Connect Client for Windows and Mac is a desktop application for Windows and Mac with features to manage email, chat messages, calendar, contacts, tasks and notes. A security vulnerability exists in Kerio Connect versions 8.0.0...

ownCloud: Arbitrary Code Injection in ownCloud’s Windows Client

The current ownCloud Windows Desktop client is prone to an arbitrary code injection vulnerability. The underlying issue is that the ownCloud desktop client tries to load QT extensions from C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins. As any authenticated user on Windows is allowed to...

CVE-2016-4371

HPE Service Manager Software 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote authenticated users to obtain sensitive information, modify data, and conduct server-side request forgery SSRF attacks via unspecified vectors, related to the Server, Web Client, Windows Client, and...

Server side request forgery (ssrf)

HPE Service Manager Software 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote authenticated users to obtain sensitive information, modify data, and conduct server-side request forgery SSRF attacks via unspecified vectors, related to the Server, Web Client, Windows Client, and...