KLA10462 Multiple vulnerabilities in Adobe Flash Player

Multiple critical vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to execute arbitrary code or bypass security restrictions. Below is a complete list of vulnerabilities 1. An unspecified vulnerability can be exploited locally via type...

InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

CVE-2013-0340

CVE-2013-0340 concerns the expat XML parser. The issue arises from improper handling of XML entity expansion (XXE) unless an application enables XML_SetEntityDeclHandler. This can allow a remote attacker to cause denial of service (resource consumption), trigger requests to intranet endpoints, or...

CVE-2013-0340

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XMLSetEntityDeclHandler function, which allows remote attackers to cause a denial of service resource consumption, send HTTP requests to intranet servers, or read arbitrary files via a...

PSF-2014-1 CVE-2013-0340 Billion Laughs fixed in Expat 2.4.0

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XMLSetEntityDeclHandler function, which allows remote attackers to cause a denial of service resource consumption, send HTTP requests to intranet servers, or read arbitrary files via a...

CVE-2011-0340

creationtimestamp| type| source ---|---|--- 2012-12-20 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/23500 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/indusoftissymbolinternationalseparator.rb...

InduSoft Web Studio - 'ISSymbol.ocx InternationalSeparator()' Heap Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Overflow

This Metasploit module exploits a heap overflow found in InduSoft Web Studio HttpClients::IE, :uaminver = "6.0", :uamaxver = "9.0", :javascript = true, :osname = OperatingSystems::WINDOWS, :rank = NormalRanking, :classid = "3c9dff6f-5cb0-422e-9978-d6405d10718f", :method = "InternationalSeparator"...

Indusoft Thin Client ISSymbol ActiveX Control InternationalOrder buffer overflow

Added: 11/02/2012 CVE: CVE-2011-0340 BID: 47596 OSVDB: 72865 Background Indusoft Thin Client allows access to Indusoft Web Studio projects without requiring Web Studio to be installed. It includes the ISSymbol ActiveX control, which is also included in Indusoft Web Studio and Advantech Studio...

CVE-2012-0340

The CVE refers to Cisco IronPort Encryption Appliance management interface: an XSS vulnerability in the default admin/ URI, exploitable via a header parameter to inject script/HTML. Affected product/version: Cisco IronPort Encryption Appliance with software before 6.5.3. Root cause: reflective XS...

CVE-2010-0340

SQL injection vulnerability in the MJS Event Pro mjseventpro extension 0.2.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2010-0340

The CVE-2010-0340 entry concerns the MJS Event Pro (mjseventpro) TYPO3 extension, affected versions up to 0.2.1. The vulnerability is an SQL injection that enables remote attackers to execute arbitrary SQL commands via unspecified vectors. Multiple connected records (Red Hat, NVD, CVE lists) conf...

CentOS Security Advisory CESA-2009:0340 (libpng)

The remote host is missing updates to libpng announced in advisory CESA-2009:0340. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-on...

libpng, libpng10 security update

CentOS Errata and Security Advisory CESA-2009:0340 Updated libpng and libpng10 packages that fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libpng packages contain a...

Moderate: Red Hat Security Advisory: libpng security update

Updated libpng and libpng10 packages that fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libpng packages contain a library of functions for creating and manipulating PN...

CVE-2009-0340

Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. dot dot in the olang parameter to 1 mail.php and 2 mailbar.php...

CVE-2009-0340

CVE-2009-0340 affects Simple PHP Newsletter 1.5. Multiple directory traversal vulnerabilities allow remote attackers to read arbitrary files via a ".." in the olang parameter to (1) mail.php and (2) mailbar.php. Root cause: improper validation of the olang parameter enables path traversal. Impact...

CVE-2009-0340

creationtimestamp| type| source ---|---|--- 2009-01-16 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7813...

CVE-2008-0340

CVE-2008-0340 concerns Oracle Database with multiple unspecified vulnerabilities affecting the Advanced Queuing (DB02) and Oracle Spatial (DB04) components across several versions (e.g., 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3). The description notes unknown impact and remote attack...