2017 matches found
CVE-2017-10769
XnView Classic for Windows Version 2.40 might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at ntdll77df0000!memcmp+0x0000000000000018" without RPC...
(0Day) Schneider Electric U.motion Builder Local Privilege Escalation Vulnerability
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the system configuration. The web administration account is s...
CVE-2014-9927
In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist...
OurPHP administrator backend has arbitrary file operation vulnerability
OurPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. OurPHP version 1.7.1 suffers from an arbitrary file manipulation vulnerability that allows an attacker to manipulate any php file without logging in, resulting in...
tavasilia.com XSS vulnerability
Vulnerable URL: http://www.tavasilia.com/niveau4b2.swf?varlang=el=javascript:alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 317038 VIP website status:| No Check...
Groovy: Remote code execution via deserialization
It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization an...
Cookie Without Secure Flag Detected
When the secure flag is set on a cookie, the browser will prevent it from being sent over a clear text channel HTTP and only allow it to be sent when an encrypted channel is used HTTPS. The scanner discovered that a cookie was set by the server without the secure flag being set. Although the...
valueresearchonline.com XSS vulnerability
Vulnerable URL: https://www.valueresearchonline.com/ads/splash.asp?cid=1=%2FDefault%2Easp%3Futm%5Fsource%3D12344321%26utm%5Fmedium%3D12344321%26utm%5Fcampaign%3D12344321%26%3D12344321%3C!%27/!%22/!%27/%22/--!%3E%3CInput/Autofocus/%0D/Onfocus=confirm%60OPENBUGBOUNTY%60%20//%3E%3CSvg%3E Details:...
BELL-CVE-2016-10254 CVE-2016-10254 does not affect BellSoft software
Bulletin has no description...
DEBIAN-CVE-2016-9377
Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service guest crash by leveraging IDT entry miscalculation...
The vulnerability of the Android operating system, which allows a hacker to gain access to data
Vulnerabilities of kernel components, including the ION subsystem, Binder, USB driver, and the network subsystem of the Android operating system, are related to the lack of protection for sensitive data. Exploiting these vulnerabilities can allow a malicious actor to gain access to local maliciou...
CVE-2016-9369
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...
PT-2017-4109 · Qemu +1 · Qemu +1
Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 2.9.0 Description: The issue is related to the disas insn function in target/i386/translate.c of the QEMU emulator, which does not limit the instruction size when TCG mode without hardware acceleration is used. This...
The vulnerability of the Android operating system, which allows a hacker to gain access to data
The vulnerability in the Android operating system’s camera driver relates to the lack of protection for privileged data. Exploiting this vulnerability allows a malicious actor to gain access to local malicious applications without being restricted by permissions. This issue is rated as “moderate,...
The vulnerability of the Android operating system, which allows a hacker to gain access to data
The vulnerability in the NVIDIA Android operating system’s video driver is related to the lack of protection for service data. Exploiting this vulnerability allows a local attacker to gain access to local malicious applications to data that they do not have permission to access. This issue is...
The vulnerability of the Android operating system, which allows a hacker to gain access to data
The vulnerability in the Android operating system’s MediaTek driver is related to the lack of protection for privileged data. Exploiting this vulnerability allows a malicious actor to gain access to local malicious applications without being restricted by permissions. This issue is rated as...
The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code
The vulnerability related to privilege escalation in the NVIDIA libomx libnvomx library of the Android operating system is associated with lack of access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code of a local malicious application within the context o...
On Russia's Involvement in the US Election, Burlington Electric, Firecrypt, and More
Mike Mimoso and Chris Brook discuss the news of the week, including on this week’s U.S. Senate Committee on Armed Services hearing, the Burlington Electric ‘Hack’ and attribution, FireCrypt, and Security Without Borders. Download: ThreatpostNewsWrapJanuary62017.mp3 Music by Chris Gonsalves...
Claudio Guarnieri on Security Without Borders
Security researcher and activist Claudio Guarnieri talks to Mike Mimoso about a new project announced last week at the Chaos Communication Congress called Security Without Borders. The project aims to form a collective of researchers and security practitioners who volunteer to provide pen-testing...
Security update for java-1_8_0-openjdk (important)
OpenJDK Java was updated to jdk8u111 icedtea 3.2.0 to fix the following issues: Security fixes + S8146490: Direct indirect CRL checks + S8151921: Improved page resolution + S8155968: Update command line options + S8155973, CVE-2016-5542: Tighten jar checks bsc1005522 + S8156794: Extend data shari...