Tarneeb 41 - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Tarneeb 41 published at the 'play' market has multiple vulnerabilities...

northover-fuels.co.uk XSS vulnerability

Vulnerable URL: http://www.northover-fuels.co.uk/index.cfm/product/phurnacite-%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9528696...

Mozilla Addresses 14-Year-Old Bug in Firefox 41

Developers at Mozilla pushed out Firefox 41 this week and brought some much needed relief to Adblock Plus users by finally fixing a 14-year old bug in the browser. The update addresses a longstanding issue with how the browser handles memory usage by the add-on. Previously the browser created too...

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)

The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service memory corruption and application crash or possibly have unspecified other impact via unknown vectors, related to an "overflow."...

Mozilla: Buffer overflow in libvpx while parsing vp9 format video (MFSA 2015-101)

Buffer overflow in the vp9initcontextbuffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allows remote attackers to execute arbitrary code via a crafted VP9 file...

UBUNTU-CVE-2015-4519

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element...

Amazon Linux: Security Advisory (ALAS-2012-41)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HP-UX privilege escalation

Privilege escalation via execve...

Flash - Uninitialized Stack Variable MPD Parsing Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=316&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=472201 Credit is to bilou, working with the Chromium Vulnerability Rewards...

Flash AVSS.setSubscribedTags Use After Free Memory Corruption Exploit

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=303&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=470864 VULNERABILITY DETAILS...

php security update

5.3.3-46 - fix gzfile accept paths with NUL character 1213407 - fix patch for CVE-2015-4024 5.3.3-45 - fix more functions accept paths with NUL character 1213407 5.3.3-44 - soap: missing fix for 1222538 and 1204868 5.3.3-43 - core: fix multipart/form-data request can use excessive amount of CPU...

OpenSSL multiple security vulnerabilities

NULL pointer dereferences, reahable asserts, memory corruptions...

Google Chrome Blink Denial of Service Vulnerability (CNVD-2015-01510)

Google Chrome is a web browsing tool developed by Google. A security vulnerability exists in the 'V8LazyEventListener::: PrepareListenerObject' function in the bindings/core/v8/V8/LazyEventListener.cpp file in the V8 bundle for Blink used in versions of Google Chrome prior to 41.0.2272.76, where...

Google Chrome Blink Memory Misreference Vulnerability (CNVD-2015-01515)

Google Chrome is a simple and efficiently designed web browsing tool developed by Google. A memory misreference vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink before Google Chrome 41.0.2272.76 allows remote attackers to exploit t...

UBUNTU-CVE-2015-1221

Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, relate...

UBUNTU-CVE-2015-1220

Use-after-free vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted frame size ...

chromium-browser: Use-after-free in gif decoder

Use-after-free vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted frame size ...

chromium-browser: Type confusion in v8 bindings

The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecifi...

Oracle Java SE 8 < Update 41 Multiple Vulnerabilities

Binary data 8748.prm...

Cross site scripting

Cross-site scripting XSS vulnerability in D-Link DAP-1360 router with firmware 2.5.4 and later allows remote attackers to inject arbitrary web script or HTML via the resbuf parameter to index.cgi when resconfigid is set to 41...