Cisco has released a security update stating that an issue in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated but unprivileged, (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of user privileges when using […]
Adobe has released a security update stating that the following issues have been discovered in Adobe Acrobat & Reader: a) Multiple security bypass privilege escalation – (CVE-2018-16018). b) Multiple use after free arbitrary code execution (CVE-2018-16011). Successful exploitation of these vulnerabilities could result in the attacker gaining control of the affected system and depending on […]
Microsoft has released a security update stating that a remote code execution issue exists in the scripting engine that handles objects in memory in Internet Explorer ver 9, 10 & 11. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. In […]
Google has released a security update stating that an use-after-free issue in PDFium could allow for arbitrary code execution (CVE-2018-17481). Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code through the browser and depending on the privileges associated with the application, an attacker could install programs view, change, delete data or […]
Mozilla has released a security update stating that it has discovered the following issues with Microsoft FireFox ver 64.0: a) A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. b) A use-after-free vulnerability can occur after deleting a selection element […]
WordPress has released a security update stating that it has discovered the following vulnerabilities with WordPress ver 5.0 and earlier: a) Authors can alter meta data to delete files that they are not authorized to. b) Authors can create posts of unauthorized post types with specially crafted input. c) URL inputs can lead to a […]
Cisco has released a security update stating that it has discovered a vulnerability in the web framework code of Cisco Prime License Manager (PLM) which could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. This is due to a lack of proper validation of user-supplied input in SQL queries and as a result, […]
Google has released a security update stating that the following issues have been discovered in the Android OS: a) Elevation of privilege vulnerability in Framework – (CVE-2018-9547). b) Information disclosure vulnerability in Framework – (CVE-2018-9548). c) Multiple arbitrary code execution in System – (CVE-2018-9555, CVE-2018-9556). d) Multiple vulnerabilities in Qualcomm components – (CVE-2018-11960, CVE-2018-11961, CVE-2018-11963). […]
Samba Team has released a security update stating that all versions of Samba from ver 4.0.0 onwards are vulnerable to infinite query recursions caused by CNAME loops. Attackers can exploit this vulnerability by adding and removing Domain Name Service (DNS) Records by using the ldbadd tool. Further information on this vulnerability and how it can […]
VMware has released a security update stating that VMware Workstation and Fusion contain an integer overflow vulnerability in the virtual network devices. This issue may allow a guest to execute code on the host. Further information on this vulnerability and how it can be mitigated can be found on the VMware Website at https://www.vmware.com/security/advisories/VMSA-2018-0030.html
