3347 matches found
For Youtube advanced Flash vulnerability bug research-vulnerability warning-the black bar safety net
A, media Flash is still a lively intimidating origin. In 2017, I isolated to Facebook, Youtube, WordPress, Yahoo, Paypal and Stripe to submit a Flash flaws. In the past 3 years, I to the flaws winning the narratives presented across 50 Flash flaws, get across the 80k dollar awards. Since Spirit i...
Hashicorp vagrant-vmware-fusion 4.0.23 Local Root Privilege Escalation
CVE-2017-11741 Local root privesc in Hashicorp vagrant-vmware-fusion = 4.0.23 2 Aug 2017 06:49 A couple of weeks ago I disclosed a local root privesc in Hashicorp's vagrant-vmware-fusion plugin: https://m4.rkw.io/blog/cve20177642-local-root-privesc-in-hashicorp-vagrantvmwarefusion--4020.html The...
Remote Code Execution (RCE)
OrientDB Core is vulnerable to remote code execution RCE attacks. Permissions are not enforced on a user executing a statement to the ORole structure containing a where, fetchplan or order by statement. By executing a groovy function where the groovy wrapper doesn't have a sandbox, any system...
Fedora 25 : php (2017-b674dc22ad)
PHP version 7.0.21 06 Jul 2017 Core: - Fixed bug php74738 Multiple PATH= and HOST= sections not properly parsed. Manuel Mausz - Fixed bug php74658 Undefined constants in array properties result in broken properties. Laruence - Fixed misparsing of abstract unix domain socket names. Sara - Fixed bu...
CVE-2017-8565
Windows PowerShell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability when PSObject wraps a CIM Instance, aka "Windows PowerShel...
PT-2017-4019
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 56 Description The issue is related to the "instanceof" operator, which can bypass the Xray wrapper mechanism. This allows web content to provide its own result for the operator, potentially tricking the browser or...
openstack-nova: Sensitive information included in legacy notification exception contexts
An information exposure issue was discovered in OpenStack Compute's exceptionwrapper.py. Legacy notification exception contexts appearing in ERROR-level logs could include sensitive information such as account passwords and authorization tokens...
openstack-nova: Sensitive information included in legacy notification exception contexts
An information exposure issue was discovered in OpenStack Compute's exceptionwrapper.py. Legacy notification exception contexts appearing in ERROR-level logs could include sensitive information such as account passwords and authorization tokens...
Poppler pdfunite Denial of Service Vulnerability
Poppler is a C++ class library for generating PDF, the library is inherited from Xpdf PDF reader. pdfunite is a Ruby wrapper. Poppler 0.55.0 and previous versions of pdfunit has a security vulnerability. An attacker can exploit this vulnerability to cause a denial of service...
Mercurial Custom hg-ssh Wrapper Remote Code Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Mercurial Custom hg-ssh Wrapper Remote Code Exec", 'Description' = %q This module takes advantage of custom hg-ssh wrapper implementations that...
Mercurial Custom hg-ssh Wrapper Remote Code Execution Exploit
This Metasploit module takes advantage of custom hg-ssh wrapper implementations that don't adequately validate parameters passed to the hg binary, allowing users to trigger a Python Debugger session, which allows arbitrary Python code execution. This module requires Metasploit:...
Code Injection (Php://input Wrapper)
A modern web application will be reliant on several different programming languages. These languages can be broken up in two flavours. These are client-side languages such as those that run in the browser -- like JavaScript and server-side languages which are executed by the server -- like ASP,...
PT-2017-17580
Name of the Vulnerable Software and Affected Versions OpenStack Nova versions 13.x through 13.1.3 OpenStack Nova versions 14.x through 14.0.4 OpenStack Nova versions 15.x through 15.0.1 Description An issue in exception wrapper.py may cause legacy notification exception contexts to include...
Local Elevation of Privilege Vulnerability in Multiple Intel Products
Intel Parallel Studio X is a suite of software for improving application performance and big data analytics; Intel Inspector is a suite of tools for dynamically testing applications for memory access errors and thread access errors. Intel Inspector is a set of tools specialized in dynamically...
CVE-2017-5682
Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives,...
PT-2017-16668
Name of the Vulnerable Software and Affected Versions Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives,...
Intel PSET Application Install wrapper contains an escalation of privilege vulnerability.
Summary: Intel PSET Application Install wrapper contains an escalation of privilege vulnerability. Description: Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer a...
CVE-2017-5682: Undefined Security Weakness
Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives,...
Gradle Arbitrary Code Execution Vulnerability
Gradle is a set of JVM-based project build tools , it supports maven, Ivy repository and so on. A security vulnerability exists in the Object Socket Wrapper.java file in Gradle version 2.12. Remote attackers can exploit the vulnerability to execute arbitrary code with the help of specially crafte...