Apple has reported that a vulnerability exists in iCloud For Windows 7.2 where an attacker in a privileged network position can track a user. This is due to a privacy issue which existed in the use of client certificates. Further information on this vulnerability and how it can be fixed can be found on the […]
CERT Coordination Center (CERT/CC) has released information on a Transport Layer Security (TLS) vulnerability. Exploitation of this vulnerability could allow an attacker to access sensitive information. The TLS vulnerability is also known as Return of Bleichenbacher’s Oracle Threat (ROBOT). ROBOT allows an attacker to obtain the RSA key necessary to decrypt TLS traffic under certain […]
Microsoft has reported that A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker […]
Google has reported several vulnerabilities with regards to Google Chrome which includes: a) Out of bounds write in QUIC – (CVE-2017-15407) b) Heap buffer overflow in PDFium – (CVE-2017-15408) c) Out of bounds write in Skia – (CVE-2017-15409) d) Use after free in PDFium – (CVE-2017-15410, CVE-2017-15411) e) Use after free in libXML – (CVE-2017-15412) […]
Multiple vulnerabilities have been identified in Mozilla Thunderbird, the most severe of which could allow for arbitrary code execution. Details of the vulnerabilities are as follows: a) A use-after-free vulnerability can occur when flushing and resizing layout because the PressShell object has been freed while still in use. This results in a potentially exploitable crash […]
The Apache Software Foundation has release security updates to address multiple vulnerabilities in Apache Struts version 2: a) A denial of service vulnerability exists due to an outdated JSON-lib library utilized by a REST plugin – (CVE-2017-15707). b) A remote code execution vulnerability exists because the REST Plugin utilizes Jackson JSON library for data binding […]
Cisco has released a security update stating that multiple vulnerabilities exist in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit these vulnerabilities by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to […]
Apple has released a security update stating that Apple MacOS High Sierra (10.13) contains a flaw in how it authenticates disabled accounts. When a privileged action prompts the user for administrative credentials, the user can simply enter the user of “root” with an empty password. The first attempt appears to fail, but in actuality, this […]
Intel has released security updates to address vulnerabilities in the firmware of the following Intel products: Management Engine, Server Platform Services, and Trusted Execution Engine. An attacker could exploit some of these vulnerabilities to take control of an affected system. Further information on these vulnerabilities and how they can be fixed can be found on […]
Symantec has a security update stating that the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there is insufficient security validation / sanitization of user-supplied input file names, such that characters representing “traverse to parent directory” are passed through to the file […]
