CVE-2012-2016
published 2012-06-29CVE-2012-2016: Unspecified vulnerability in HP System Management Homepage (SMH) before 7.1.1 allows local users to obtain sensitive information via unknown vectors.
PriorityP412medium4.9CVSS 2.0
AVLACLAuNCCINAN
EPSS
0.65%
47.2th percentile
Unspecified vulnerability in HP System Management Homepage (SMH) before 7.1.1 allows local users to obtain sensitive information via unknown vectors.
Affected
101 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | system_management_homepage | <= 7.1.0-16 | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
CVSS provenance
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4g98-5r9j-pqh2: Unspecified vulnerability in HP System Management Homepage (SMH) before 7
ghsa_unreviewed·2022-05-13
CVE-2012-2016 [MEDIUM] GHSA-4g98-5r9j-pqh2: Unspecified vulnerability in HP System Management Homepage (SMH) before 7
Unspecified vulnerability in HP System Management Homepage (SMH) before 7.1.1 allows local users to obtain sensitive information via unknown vectors.
Microsoft
NetLogon Elevation of Privilege Vulnerability
vendor_msrc·2016-08-09·CVSS 6.8
CVE-2016-3300 [HIGH] NetLogon Elevation of Privilege Vulnerability
NetLogon Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists when Windows Netlogon improperly establishes a secure communications channel to a domain controller. An attacker who successfully exploited the vulnerability could run a specially crafted application on a domain-joined system.
To exploit the vulnerability, an attacker would require access to a domain-joined machine that points to a domain controller running either Windows Server 2012 or Windows Server 2012 R2.
The update addresses the vulnerability by modifying how Netlogon handles the establishment of secure channels.
Windows Authentication Methods: Windows Authentication Methods
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Rele
Microsoft
Internet Explorer Security Feature Bypass Vulnerability
vendor_msrc·2016-05-10·CVSS 8.8
CVE-2016-0188 [HIGH] Internet Explorer Security Feature Bypass Vulnerability
Internet Explorer Security Feature Bypass Vulnerability
Description: A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies.
To exploit the vulnerability, a user could either visit a malicious website or an attacker with access to the system could run a specially crafted application. An attacker could then leverage the vulnerability to run unsigned malicious code as though it were signed by a trusted source.
The update addresses the vulnerability by correcting how Internet Explorer validates UMCI policies.
FAQ: I am running Internet Explorer on Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2.
No public exploits indexed.
Qualys
July Patch Tuesday: 19 Critical Vulnerabilities from Microsoft, plus Critical Adobe Patches
blogs_qualys·2017-07-11·CVSS 7.8
CVE-2017-8589 [HIGH] July Patch Tuesday: 19 Critical Vulnerabilities from Microsoft, plus Critical Adobe Patches
Today Microsoft released patches covering 54 vulnerabilities as part of July’s Patch Tuesday update, with 26 of them affecting Windows. Patches covering 19 of these vulnerabilities are labeled as Critical, all of which can result in Remote Code execution. According to Microsoft, none of these vulnerabilities are currently being exploited in the wild.
Top priority for patching should go to CVE-2017-8589 , which is a vulnerability in the Windows Search service. This vulnerability can be exploited remotely via SMB to take complete control of a system, and can impact both servers and workstations. The issue affects Windows Server 2016, 2012, 2008 R2, 2008 as well as desktop systems like Windows 10, 7 and 8.1. While this vulnerability can leverage SMB as an attack vector, this is not a vulnera
Fortinet
iSNS Server Memory Corruption Vulnerability in Microsoft Windows Server
blogs_fortinet·2017-03-23·CVSS 8.1
CVE-2017-0104 [HIGH] iSNS Server Memory Corruption Vulnerability in Microsoft Windows Server
FORTIGUARD LABS THREAT RESEARCH
iSNS Server Memory Corruption Vulnerability in Microsoft Windows Server
By Honggang Ren | March 23, 2017
Summary
In November 2016, as part of my FortiGuard research work, I discovered and reported on an iSNS server memory corruption vulnerability in Microsoft Windows Server. On patch Tuesday of March 2017, Microsoft released the Security Bulletin MS17-012 that contain the fix for this vulnerability and identifies it as CVE-2017-0104.
This vulnerability could lead to remote code execution, and is rated as critical by Microsoft. The vulnerability affects Windows Server 2008, 2012, and 2016 versions. Microsoft recommends installing this update immediately.
In this blog I will share the details of this vulnerability.
How to Reproduce
To reproduce the vulne
Unit42
NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan
blogs_unit42·2016-01-21·CVSS 8.8
[HIGH] NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan
## NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan
Vicky Ray
Robert Falcone
Published: January 21, 2016
Malware
Threat Research
NetTraveler
Spear Phishing
Trojan
Ufa
Ufe
Uzbekistan
Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China. A spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan who is likely based in Beijing, China. In this report, we’ll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan.
On December 12, 2015, a spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan. The body and subject of the email suggests that the email was spoofed to look like it was sent by the Russian Foreign Ministry and the att
Bugzilla
CVE-2012-6703 kernel: Integer overflow in compress_core
bugzilla·2016-06-29·CVSS 7.8
CVE-2012-6703 [HIGH] CVE-2012-6703 kernel: Integer overflow in compress_core
CVE-2012-6703 kernel: Integer overflow in compress_core
An integer overflow was found in snd_compr_allocate_buffer(), that could result into allocating smaller buffer than expected.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b35cc8225845112a616e3a2266d2fde5ab13d3ab
The patch was incomplete and introduced another issues known as CVE-2014-9904.
CVE assignment:
http://seclists.org/oss-sec/2016/q2/616
2012-06-29
Published