Oracle Outside In PDF 8.5.2 - Parsing Memory Corruption (2)

Oracle Outside In PDF 8.5.2 - Parsing Memory Corruption 2 Application: Oracle Outside In Platforms: Windows Versions: 8.5.2 CVE: CVE-2015-4878 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction...

Oracle Outside In PDF 8.5.2 - Parsing Memory Corruption (2)

Application: Oracle Outside In Platforms: Windows Versions: 8.5.2 CVE: CVE-2015-4878 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== Oracle Outside In Technology provides software...

CVE-2015-4878

CVE-2015-4877 and CVE-2015-4878 describe an unspecified vulnerability in Oracle Outside In Technology (Outside In Filters) used by Oracle Fusion Middleware, enabling local denial-of-service by a non-privileged user on systems with Oracle Fusion Middleware 8.5.0–8.5.2. Public advisories from IBM (...

Remote Code Execution in Popular Hikvision Surveillance DVR

A number Hikvision digital video recorders contain vulnerabilities that an attacker could remotely exploit in order to gain full control of those devices. According to a report written by the security firm Rapid7, Hikvision’s DVRs contain three fairly typical buffer overflows in the request...

CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

CVE-2013-4878

CVE-2013-4878 affects Parallels Plesk Panel 9.0.x–9.2.x on UNIX and Small Business Panel 10.x on UNIX, due to an improper ScriptAlias directive for phppath that enables remote code execution via crafted requests. Affected versions expose code execution under the web server user; exploitation reli...

CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

CVE-2012-4878

FlatnuX CMS 2011 08.09.2 is affected by an absolute path traversal in controlcenter.php, allowing remote administrators to read arbitrary files via a full pathname supplied in the dir parameter of a contents/Files action. The underlying issue is a path traversal vulnerability that enables access ...

PHP php-cgi Query String Parameter Code Execution (CVE-2012-1823; CVE-2012-2311; CVE-2012-2335; CVE-2012-2336; CVE-2013-4878)

A remote code execution vulnerability has been reported in PHP. The vulnerability is due to the improper parsing and filtering of query strings by PHP. A remote attacker may exploit this issue by sending crafted HTTP requests. Successful exploitation would allow an attacker to execute arbitrary...

CVE-2012-4878

creationtimestamp| type| source ---|---|--- 2012-04-01 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/37034...

CVE-2011-4878

Siemens WinCC/HMI Web Server is vulnerable to a directory traversal in the HMI web server component (miniweb.exe) affecting WinCC flexible 2004–2008, WinCC V11 (TIA Portal) before SP2 Update 1, and related SIMATIC HMI panels and runtimes. Root cause: improper validation of HTTP/URI strings allows...

KLA10394 Multiple vulnerabilities in Siemens

Multiple critical vulnerabilities have been found in Siemens products. Malicious users can exploit these vulnerabilities to read & modify arbitrary files, cause denial of service, execute arbitrary code, bypass authentication, obtain access and inject arbitrary HTTP headers. Below is a complete...

CVE-2011-4878

creationtimestamp| type| source ---|---|--- 2011-11-28 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18166...

CVE-2010-4878

CVE-2010-4878 : A PHP remote file inclusion vulnerability exists in Kontakt Formular 1.1 , specifically in the file formmailer.php . The issue allows remote attackers to execute arbitrary PHP code by supplying a URL in the script_pfad parameter. Root cause is a vulnerable inclusion mechanism that...

CVE-2010-4878

PHP remote file inclusion vulnerability in formmailer.php in Kontakt Formular 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the scriptpfad parameter...

CVE-2010-4878

creationtimestamp| type| source ---|---|--- 2010-08-26 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14809...

CVE-2009-4878

Technical details about CVE-2009-4878 are not provided in the supplied documents; no specifics on affected versions, root cause, or remediation are available. Monitor for updates.

CVE-2005-4878

Multiple cross-site scripting XSS vulnerabilities in 1 acidqrymain.php in Analysis Console for Intrusion Databases ACID 0.9.6b20 and 2 baseqrymain.php in Basic Analysis and Security Engine BASE 1.2, and unspecified other console scripts in these products, allow remote attackers to inject arbitrar...

CVE-2005-4878

Multiple cross-site scripting XSS vulnerabilities in 1 acidqrymain.php in Analysis Console for Intrusion Databases ACID 0.9.6b20 and 2 baseqrymain.php in Basic Analysis and Security Engine BASE 1.2, and unspecified other console scripts in these products, allow remote attackers to inject arbitrar...