Collaborate Disseminate
Think Mutual Bank mobile banking app for iOS,version 3.1.5 and earlier,fails to properly validate SSL certificates provided by HTTPS connections,which may enable an attacker to conduct man-in-the-middle(MITM)attacks. Continue reading VU#276408: Think Mutual Bank Mobile Banking App for iPhone fails to properly validate SSL certificates
Technologies based on Intel Active Management Technology may be vulnerable to remote privilege escalation,which may allow a remote,unauthenticated attacker to execute arbitrary code on the system. Continue reading VU#491375: Intel Active Management Technology (AMT) does not properly enforce access control
Applications developed using the Portrait Display SDK,versions 2.30 through 2.34,default to insecure configurations which allow arbitrary code execution. Continue reading VU#219739: Portrait Displays SDK applications are vulnerable to arbitrary code execution and privilege escalation
The IBM Lotus Domino server IMAP service contains a stack-based buffer overflow vulnerability in IMAP commands that refer to a mailbox name. This can allow a remote,authenticated attacker to execute arbitrary code with the privileges of the Domino server Continue reading VU#676632: IBM Lotus Domino server mailbox name stack buffer overflow
The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point,and allows full file permissions to the anonymous user. Continue reading VU#334207: DBPOWER U818A WIFI quadcopter drone allows full filesystem permissions to anonymous FTP
Microsoft OLE uses the URL Moniker to open application data based on the server-provided MIME type,which can allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system. Continue reading VU#921560: Microsoft OLE URL Moniker improperly handles remotely-linked HTA data
Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references. Continue reading VU#307983: Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references
GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 and GB-BXi7-5775 platforms,versions vF6 and vF2 respectively,fails to properly set the BIOSWE,BLE,SMM_BWP,and PRx bits to enforce write protection. It also is not cryptographically signed. These issues may permit an attacker to write arbitrary code to the platform firmware,potentially allowing for persistent firmware level rootkits or the creation of a permanent denial of service condition in the platform. Continue reading VU#507496: GIGABYTE BRIX UEFI firmware fails to implement write protection and is not cryptographically signed
The Pandora iOS app fails to properly validate SSL certificates provided by HTTPS connections,which may enable an attacker to conduct man-in-the-middle(MITM)attacks. Continue reading VU#342303: Pandora iOS app does not properly validate SSL certificates
PCAUSA’s Rawether framework does not properly validate BPF data,allowing a crafted malicious BPF program to perform operations on memory outside of its typical bounds on the driver’s receipt of network packets. This vulnerability may be exploited to perform local privilege escalation on Windows systems. Continue reading VU#600671: PCAUSA Rawether for Windows local privilege escalation