Preface: MsiAdvertiseProduct function enables the installer to write to a script the registry and shortcut information used to assign or publish a product. Vulnerability details: Due to improper validation, the affected function can be abused to force installer service into making a copy of any file as SYSTEM privileges and read its content, resulting in…

Preface: Dokan is a user mode file system for Windows. It allows anyone to safely and easily develop new file systems on Windows operating systems. Technical details: When you want to create a new file system on Windows you need to develop a file system driver. Developing a device driver that works in the kernel…

Preface: “I Saw Mommy Kissing Santa Claus” is a famous Christmas song.But perhaps that it is the hacker kissing your Internet Explorer web browser before christmas time. Above description has similarity because both two people are the famous guy in the world. Detail description: ChakraCore is the core part of Chakra, the high-performance JavaScript engine…

Preface: Firewall solutions are essential to protect organizations from potential cyber threats. HTTPS is used to make communication between the server and the browser secure. Key factor of Cyber security:It is hard to avoid vulnerability will be occured in digital products today. But the most critical issue is that how to know and the efficiency…

Preface: Webroot delivers next-generation endpoint security and threat intelligence services to protect businesses and individuals in a connected world. Technical background: The Webroot BrightCloud® Mobile Security SDK addresses mobile device vulnerabilities by enabling mobile management partners to offer enhanced security . Vulnerability found on 17th Dec 2018:CUJO Smart Firewall (ver 7003) provides services to avoid…

Preface: Vulnerabilities are flaws in computer software that create weaknesses in your computer or network overall security.Can you imagine that what is the actual situation before vulnerability found? Background information: Jenkins is the leading open-source automation server. Built with Java, it provides over 1000 plugins to support automation. Vulnerability announcement on 17th Dec 2018:The vulnerability…

Preface: Xen Project is a hypervisor using a microkernel design, providing services that allow multiple computer operating systems to execute on the same computer hardware concurrently. Vulnerability description:The vulnerability is due to an interpretation conflict for union data structure associated with shadow paging.The XSA-240 introduced a new field into the control structureassociated with each page…