Collaborate Disseminate
CWE-400:Uncontrolled Resource Consumption(‘Resource Exhaustion’)- CVE-2018-5391 The Linux kernel,versions 3.9+,is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may c… Continue reading VU#641765: Linux kernel IP fragment re-assembly vulnerable to denial of service
Auto-Maskin RP remote panels and DCU controls units are used to monitor and control ship engines. The units have several authentication and encryption vulnerabilities which can allow attackers to access the units and control connected engines. Continue reading VU#176301: Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App
Ghostscript contains an optional -dSAFER option,which is supposed to prevent unsafe PostScript operations. Multiple PostScript operations bypass the protections provided by -dSAFER,which can allow an attacker to execute arbitrary commands with arbitrar… Continue reading VU#332928: Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities
The TP-LINK EAP Controller is TP-LINK’s software for remotely controlling wireless access point devices. EAP Controller for Linux lacks user authentication for RMI service commands,as well as utilizes an outdated vulnerable version of Apache commons-collections,which may allow an attacker to implement deserialization attacks and control the EAP Controller server. Continue reading VU#581311: TP-Link EAP Controller lacks RMI authentication and is vulnerable to deserialization attacks
CWE-400:Uncontrolled Resource Consumption(‘Resource Exhaustion’)- CVE-2018-5390 Linux kernel versions 4.9+can be forced to make very expensive calls to tcp_collapse_ofo_queue()and tcp_prune_ofo_queue()for every incoming packet which can lead to a denia… Continue reading VU#962459: TCP implementations vulnerable to Denial of Service
Many Android mobile devices come with OEM-pre-installed apps. Some apps have been identified as having incorrect access control settings,allowing malicious third-party apps to exploit and bypass system permissions and settings. Additionally,some Androi… Continue reading VU#787952: Android and iOS apps contain multiple vulnerabilities
The Microsoft Windows task scheduler SchRpcSetSecurity API contains a vulnerability in the handling of ALPC,which can allow an authenticated user to overwrite the contents of a file that should be protected by filesystem ACLs. This can be leveraged to … Continue reading VU#906424: Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the ALPC interface
Speculative execution is a technique used by many modern processors to improve performance by predicting which instructions may be executed based on past execution history. When a program attempts to access data in memory,the logical memory address is … Continue reading VU#982149: Intel processors are vulnerable to a speculative execution side-channel attack called L1 Terminal Fault (L1TF)
Automatic DNS registration and autodiscovery functionality provides an opportunity for the misconfiguration of networks,resulting in a loss of confidentiality and integrity of the network if an attacker on the network adds a specially configured proxy device. Continue reading VU#598349: Automatic DNS registration and proxy autodiscovery allow spoofing of network services
Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the Advanced Local Procedure Call(ALPC)interface,which can allow a local user to obtain SYSTEM privileges. Continue reading VU#906424: Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the ALPC interface