VU#974272: Microsoft Outlook retrieves remote OLE content without prompting
When a Rich Text(RTF)email is previewed in Microsoft Outlook,remotely-hosted OLE content is retrieved without requiring any additional user …
Browsing: CERT
VU#739007: IEEE P1735 implementations may have weak cryptographic protections
The P1735 IEEE standard describes methods for encrypting electronic-design intellectual property(IP),as well as the management of access …
VU#446847: Savitech USB audio drivers install a new root CA certificate
Savitech provides USB audio drivers for a number of specialized audio products. Some versions of the Savitech driver package silently …
VU#307015: Infineon RSA library does not properly generate RSA key pairs
The Infineon RSA library version 1.02.013 does not properly generate RSA key pairs,which may allow an attacker to recover the RSA private …
VU#277400: Windows 7 and Windows Server 2008 R2 x64 fail to protect kernel memory when the Microsoft patch for meltdown is installed
When the Microsoft patch for meltdown is installed on a Windows 7 x64 or Windows Server 2008 R2 x64 system,an unprivileged process may be …
VU#184077: Navarino Infinity web interface is affected by multiple vulnerabilities.
Navarino Infinity web interface up to version 2.2 is affected by multiple …
VU#306792: Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions
Bouncy Castle BKS version 1 keystore files use an HMAC that is only 16 bits long,which can allow an attacker to crack a BKS-V1 keystore …
VU#475445: Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
Multiple SAML libraries may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker …
VU#940439: Quagga bgpd is affected by multiple vulnerabilities
The Quagga BGP daemon bgpd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service,information …
VU#319904: Pulse Secure Linux client GUI fails to validate SSL certificates
The Pulse Secure Linux client GUI fails to validate SSL certificates,which can allow an attacker to modify connection …
VU#584653: CPU hardware vulnerable to side-channel attacks
CPU hardware implementations are vulnerable to cache side-channel attacks. These vulnerabilities are referred to as Meltdown and …
VU#144389: TLS implementations may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding
TLS implementations may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding,and may therefore be …
VU#113765: Apple MacOS High Sierra disabled account authentication bypass
Apple MacOS High Sierra fails to properly require authentication for disabled accounts,such as root account,which can allow an …
VU#681983: Install Norton Security for Mac does not verify SSL certificates
Install Norton Security for Mac,prior to version 7.6,does not validate SSL …
VU#817544: Windows 8 and later fail to properly randomize every application if system-wide mandatory ASLR is enabled via EMET or Windows Defender Exploit Guard
Microsoft Windows 8 introduced a change in how system-wide mandatory ASLR is implemented. This change requires system-wide bottom-up ASLR …
VU#421280: Microsoft Office Equation Editor stack buffer overflow
Microsoft Equation Editor contains a stack buffer overflow,which can allow a remote,unauthenticated attacker to execute arbitrary code on a …
CERT.org Goes Away, Panic Ensues
When a major security-based website goes away, people notice and often assume the worst. So while the Carnegie Mellon Community Emergency …
VU#940439: Quagga bgpd is affected by multiple vulnerabilities …
The Quagga BGP daemon bpgd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service,information …
VU#940439: Quagga bpgd is affected by multiple vulnerabilities …
The Quagga BGP daemon bpgd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service,information …
VU#319904: Pulse Secure Linux client GUI fails to validate SSL certificates …
The Pulse Secure Linux client GUI fails to validate SSL certificates,which can allow an attacker to modify connection …
VU#584653: CPU hardware vulnerable to side-channel attacks …
CPU hardware implementations are vulnerable to side-channel attacks. These vulnerabilities are referred to as Meltdown and …
VU#144389: TLS implementations may disclose side channel information via discrepencies between valid and inval …
TLS implementations may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding,and may therefore …
VU#113765: Apple MacOS High Sierra disabled account authentication bypass …
Apple MacOS High Sierra fails to properly require authentication for the root account,which can allow an authenticated user to obtain root …
VU#113765: Apple MacOS High Sierra root authentication bypass …
Apple MacOS High Sierra fails to properly require authentication for the root account,which can allow an authenticated user to obtain root …
VU#681983: Install Norton Security for Mac does not verify SSL certificates …
Install Norton Security for Mac,prior to version 7.6,does not validate SSL …
VU#817544: Windows 8 and later fail to properly randomize every application if system-wide mandatory ASLR is e …
Microsoft Windows 8 introduced a change in how system-wide mandatory ASLR is implemented. This change requires system-wide bottom-up ASLR …
VU#817544: Windows 8 and later fail to properly randomize all applications if system-wide mandatory ASLR is en …
Microsoft Windows 8 introduced a change in how system-wide mandatory ASLR is implemented. This change requires system-wide bottom-up ASLR …
VU#817544: Windows 8.0 and later fail to properly randomize all applications if system-wide mandatory ASLR is …
Microsoft Windows 8.0 introduced a change in how system-wide mandatory ASLR is implemented. This change requires system-wide bottom-up ASLR …
VU#421280: Microsoft Office Equation Editor stack buffer overflow …
Microsoft Equation Editor contains a stack buffer overflow,which can allow a remote,unauthenticated attacker to execute arbitrary code on a …
VU#739007: IEEE P1735 implementations may have weak cryptographic protections …
The P1735 IEEE standard describes methods for encrypting electronic-design intellectual property(IP),as well as the management of access …