zer0dayeurope-blog

[zer0dayeurope-blog]

Medium CVE-2016-10165: Debian Debian linux

Medium CVE-2016-10165: Debian Debian linux

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image…

[zer0dayeurope-blog]

Low CVE-2016-7147: Plone Plone

Low CVE-2016-7147: Plone Plone

Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.Cross-site…

[zer0dayeurope-blog]

High CVE-2017-5136: Sendquick Avera sms gateway firmware

High CVE-2017-5136: Sendquick Avera sms gateway firmware

An issue was discovered on SendQuick Entera and Avera devices before 2HF16. The application failed to check the access control of the request which could result in an attacker being able to shutdown the system.An issue was discovered on SendQuick Entera and Avera devices before 2HF16. The application failed to check the access control of the request which could result in an attacker being able to…

[zer0dayeurope-blog]

Medium CVE-2010-5328: Linux Linux kernel

Medium CVE-2010-5328: Linux Linux kernel

include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapper process, which allows local users to cause a denial of service (system crash) by leveraging access to this process group.include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the…

[zer0dayeurope-blog]

High CVE-2016-10150: Linux Linux kernel

High CVE-2016-10150: Linux Linux kernel

Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows…

[zer0dayeurope-blog]

Medium CVE-2016-10153: Linux Linux kernel

Medium CVE-2016-10153: Linux Linux kernel

The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging reliance on earlier net/ceph/crypto.c code.The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly…

[zer0dayeurope-blog]

Medium CVE-2017-2583: Linux Linux kernel

Medium CVE-2017-2583: Linux Linux kernel

The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a “MOV SS, NULL selector” instruction, which allows guest OS users to cause a denial of service (guest OS crash) or gain guest OS privileges via a crafted application.The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5…

[zer0dayeurope-blog]

Medium CVE-2017-5546: Linux Linux kernel

Medium CVE-2017-5546: Linux Linux kernel

The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service (duplicate freelist entries and system crash) or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a random number.The freelist-randomization feature in mm/slab.c in the Linux kernel…

[zer0dayeurope-blog]

Medium CVE-2017-5548: Linux Linux kernel

Medium CVE-2017-5548: Linux Linux kernel

drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6…

[zer0dayeurope-blog]

Medium CVE-2017-5547: Linux Linux kernel

Medium CVE-2017-5547: Linux Linux kernel

drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts…

[zer0dayeurope-blog]

Low CVE-2017-5550: Linux Linux kernel

Low CVE-2017-5550: Linux Linux kernel

Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninitialized heap-memory locations in opportunistic circumstances by reading from a pipe after an incorrect buffer-release decision.Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local…

[zer0dayeurope-blog]

Medium CVE-2017-5577: Linux Linux kernel

Medium CVE-2017-5577: Linux Linux kernel

The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 does not set an errno value upon certain overflow detections, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) via inconsistent size values in a VC4_SUBMIT_CL ioctl call.The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the…

[zer0dayeurope-blog]

Medium CVE-2015-2794: Dotnetnuke Dotnetnuke

Medium CVE-2015-2794: Dotnetnuke Dotnetnuke

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx. Source from..

[zer0dayeurope-blog]

Medium CVE-2017-5879: Exponentcms Exponent cms

Medium CVE-2017-5879: Exponentcms Exponent cms

An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects source_selector.php and the following parameter: src.An issue was discovered in Exponent CMS…

[zer0dayeurope-blog]

Low CVE-2017-5876: Dotcms Dotcms

Low CVE-2017-5876: Dotcms Dotcms

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter.XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter. Source from..

[zer0dayeurope-blog]

Low CVE-2017-5875: Dotcms Dotcms

Low CVE-2017-5875: Dotcms Dotcms

XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter.XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter. Source from..

[zer0dayeurope-blog]

Low CVE-2017-5877: Dotcms Dotcms

Low CVE-2017-5877: Dotcms Dotcms

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter.XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter. Source from..