The vulnerability of the Android operating system, which allows a hacker to gain access to data

The vulnerability in the Android operating system’s camera driver relates to the lack of protection for privileged data. Exploiting this vulnerability allows a malicious actor to gain access to local malicious applications without being restricted by permissions. This issue is rated as “moderate,...

The vulnerability of the Android operating system, which allows a hacker to gain access to data

The vulnerability in the NVIDIA Android operating system’s video driver is related to the lack of protection for service data. Exploiting this vulnerability allows a local attacker to gain access to local malicious applications to data that they do not have permission to access. This issue is...

The vulnerability of the Android operating system, which allows a hacker to gain access to data

The vulnerability in the Android operating system’s MediaTek driver is related to the lack of protection for privileged data. Exploiting this vulnerability allows a malicious actor to gain access to local malicious applications without being restricted by permissions. This issue is rated as...

The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability related to privilege escalation in the NVIDIA libomx libnvomx library of the Android operating system is associated with lack of access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code of a local malicious application within the context o...

On Russia's Involvement in the US Election, Burlington Electric, Firecrypt, and More

Mike Mimoso and Chris Brook discuss the news of the week, including on this week’s U.S. Senate Committee on Armed Services hearing, the Burlington Electric ‘Hack’ and attribution, FireCrypt, and Security Without Borders. Download: ThreatpostNewsWrapJanuary62017.mp3 Music by Chris Gonsalves...

Claudio Guarnieri on Security Without Borders

Security researcher and activist Claudio Guarnieri talks to Mike Mimoso about a new project announced last week at the Chaos Communication Congress called Security Without Borders. The project aims to form a collective of researchers and security practitioners who volunteer to provide pen-testing...

Security update for java-1_8_0-openjdk (important)

OpenJDK Java was updated to jdk8u111 icedtea 3.2.0 to fix the following issues: Security fixes + S8146490: Direct indirect CRL checks + S8151921: Improved page resolution + S8155968: Update command line options + S8155973, CVE-2016-5542: Tighten jar checks bsc1005522 + S8156794: Extend data shari...

UBUNTU-CVE-2016-6719

An elevation of privilege vulnerability in the Bluetooth component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to pair with any Bluetooth device without user consent. This issue is...

libvirt: Setting empty VNC password allows access to unauthorized users

It was found that setting a VNC password to an empty string in libvirt did not disable all access to the VNC server as documented, instead it allowed access with no authentication required. An attacker could use this flaw to access a VNC server with an empty VNC password without any authenticatio...

File upload vulnerability in the file /justsetting/justsetting3.php of the Tidetime Communications call center system

The core of Tibco's call center system is a communication-based system for internal and external corporate communication. A file upload vulnerability exists in the file /justsetting/justsetting3.php in the Tidetime Communications Call Center System. The vulnerability can be exploited to upload a...

USN-3075-1 imlib2 vulnerabilities

Jakub Wilk discovered an out of bounds read in the GIF loader implementation in Imlib2. An attacker could use this to cause a denial of service application crash or possibly obtain sensitive information. CVE-2016-3994 Yuriy M. Kaminskiy discovered an off-by-one error when handling coordinates in...

RaiseDreams Crowdfunding System 2.2.4 suffers from a login validation design vulnerability

RaiseDreams is an enterprise-level crowdfunding website platform. A login validation design vulnerability exists in the RaiseDreams crowdfunding system 2.2.4, which arises because the user login password is not verified, allowing an attacker to exploit the vulnerability to log in to the system an...

DEBIAN-CVE-2016-5403

The virtqueuepop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service memory consumption and QEMU process crash by submitting requests without waiting for completion...

TYPO3 without PHP extension SQL injection vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the TYPO3 Association in Switzerland.Browser - TYPO3 without PHP Browser is one of the extensions that enable browsers to develop TYPO3 without PHP code. A SQL injection vulnerability exists in TYPO3 without...

The vulnerability of the automated system for managing technological processes of SIMATIC WinCC OA allows a malicious individual to execute arbitrary codes without going through authentication procedures.

The vulnerability of the SIMATIC Winn CC OAM software relates to errors that occur when processing specially crafted TCP packets. Exploiting this vulnerability allows a malicious individual to execute arbitrary code by sending specially crafted packets to port 4999...

Vulnerabilities of the enterprise automation system 1C:Enterprise, allowing a malicious individual to trigger service failures or gain access to encrypted data without knowing the encryption key

Multiple vulnerabilities in the OpenSSL cryptographic package of the 1C: enterprise automation system allow a malicious actor to remotely cause service failures or gain access to encrypted data without knowing the encryption key...

The vulnerability of the Mac OS X operating system allows a perpetrator to trigger a phone number collection event without the user’s permission.

The vulnerability of the Reminders component in the Mac OS X operating system is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, acting remotely, to trigger a phone number collection event without user permission by clicking on the “tel” link...

Unauthorized Access Vulnerability in DMS Integrated Management System of Shanghai Toothwood Communication Technology Co.

Toothwood Technology yamutech claims to be the leading integrated DNS service provider with the widest coverage area and the largest number of users in China. Multiple overstepping access vulnerabilities exist in the DMS, the network management module of yamutech's DNS equipment, allowing an...

groovy: remote execution of untrusted code in class MethodClosure

A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code...

Apple MAC OS X XPC entitlements elevation of privilege vulnerability

Apple Mac OS X is a commercial operating system. Apple Mac OS X checks for a security vulnerability in XPC entitlements, which allows attackers to exploit the vulnerability to gain administrative privileges without authentication...