Saturday, December 16, 2017

VU#334207: DBPOWER U818A WIFI quadcopter drone allows full filesystem permissions to...

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point,and allows full file permissions to the anonymous user.

VU#921560: Microsoft OLE URL Moniker improperly handles remotely-linked HTA data

Microsoft OLE uses the URL Moniker to open application data based on the server-provided MIME type,which can allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system.

VU#307983: Action Message Format (AMF3) Java implementations are vulnerable to insecure...

Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references.

VU#507496: GIGABYTE BRIX UEFI firmware fails to implement write protection and...

GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 and GB-BXi7-5775 platforms,versions vF6 and vF2 respectively,fails to properly set the BIOSWE,BLE,SMM_BWP,and PRx bits to enforce write protection. It also is not cryptographically signed. These issues may permit an attacker to write arbitrary code to the platform firmware,potentially allowing for persistent firmware level rootkits or the creation of a permanent denial of service condition in the platform.

VU#342303: Pandora iOS app does not properly validate SSL certificates

The Pandora iOS app fails to properly validate SSL certificates provided by HTTPS connections,which may enable an attacker to conduct man-in-the-middle(MITM)attacks.

VU#600671: PCAUSA Rawether for Windows local privilege escalation

PCAUSA's Rawether framework does not properly validate BPF data,allowing a crafted malicious BPF program to perform operations on memory outside of its typical bounds on the driver's receipt of network packets.

This vulnerability may be exploited to perform local privilege escalation on Windows systems.

VU#214283: Commvault Edge contains a buffer overflow vulnerability

Commvault Edge,version 11 SP6(11.80.50.0),is vulnerable to a stack-based buffer overflow vulnerability.

VU#553503: D-Link DIR-130 and DIR-330 are vulnerable to authentication bypass and...

The D-Link DIR-130 and DIR-330 are vulnerable to authentication bypass of the remote login page,and do not sufficiently protect administrator credentials.

VU#834067: Apache Struts 2 is vulnerable to remote code execution

Apache Struts,versions 2.3.5 - 2.3.31 and 2.5 - 2.5.10,is vulnerable to code injection leading to remote code execution(RCE).

VU#305448: D-Link DIR-850L web admin interface contains a stack-based buffer overflow...

D-Link DIR-850L,firmware versions 1.14B07,2.07.B05,and possibly others,contains a stack-based buffer overflow vulnerability in the web administration interface HNAP service. Other models may also be affected.

VU#247016: Flash Seats Mobile App for Android and iOS fails to...

Flash Seats Mobile App for Android,version 1.7.9 and earlier,and for iOS,version 1.9.51 and earlier,fails to properly validate SSL certificates provided by HTTPS connections,which may enable an attacker to conduct man-in-the-middle(MITM)attacks.

VU#608591: PHP FormMail Generator generates code vulnerable to multiple issues

PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting and unrestricted upload of dangerous file types.