Nvidia GeForce Experience Web Helper - Command Injection

Nvidia GeForce Experience Web Helper - Command Injection //Send request to local GFE server function submitRequestport,secret var xhr = new XMLHttpRequest; xhr.open"POST", "http://127.0.0.1:"+port+"/gfeupdate/autoGFEInstall/", true; xhr.setRequestHeader"Accept",...

NVIDIA GeForce Experience OS Command InjectionCVE-2019-5678

The post NVIDIA GeForce Experience OS Command Injection CVE-2019-5678 appeared first on Rhino Security Labs...

CVE-2019-5678

The CVE-2019-5678 issue affects NVIDIA GeForce Experience Web Helper. The vulnerability arises from input handling in the Web Helper component, where attacker-controlled input and local system access may allow code execution, denial of service, or information disclosure. The Lenovo advisory confi...

Foxit PhantomPDF < 9.1 Multiple Vulnerabilities

According to its version, the Foxit PhantomPDF application formally known as Phantom installed on the remote Windows host is prior to 9.1. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid119838; scriptversion"1.6...

CVE-2018-13799

A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior All versions V3.14-P021. Improper access control to a data point of the affected product could allow an unauthenticated remote user to escalate its privileges in the context of SIMATIC WinCC OA V3.14. This vulnerability could...

Improper access control

A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior All versions V3.14-P021. Improper access control to a data point of the affected product could allow an unauthenticated remote user to escalate its privileges in the context of SIMATIC WinCC OA V3.14. This vulnerability could...

Foxit Reader Multiple Code Execution Vulnerabilities (May 2018) - Windows

Foxit Reader is prone to multiple code execution vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Heap overflow

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific...

CVE-2018-5678

Foxit Reader/PhantomPDF before 9.1 are affected by CVE-2018-5678 due to a flaw in processing PDFs with embedded u3d images, causing a heap-based buffer overflow. An attacker can exploit this via a malicious PDF to execute arbitrary code in the current process; user interaction is required (visiti...

CVE-2016-5678

NUUUO NVRmini 2 and NVRsolo (firmware 1.0.0–3.0.0) are affected by CVE-2016-5678, which contains two hardcoded root passwords in firmware images. This enables unauthenticated remote admin access if exploited through the device web interfaces. Public PoCs and exploits exist (e.g., Exploit DB, CERT...

CVE-2014-5678

The CVE-2014-5678 entry concerns the Android app IQ Test (com.pophub.androidiqtest.free) version 3.3, which fails to verify X.509 certificates when connecting to SSL servers. The root cause is SSL certificate validation being bypassed, enabling MITM attackers to spoof servers and extract sensitiv...

SuSE 11.2 Security Update : flash-player (SAT Patch Number 7150)

This version upgrade of flash-player fixed multiple unspecified code execution vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc. i...

Adobe Flash Player SWF Traits Structure Remote Code Execution (APSB12-27; CVE-2012-5678)

A remote code execution vulnerability has been reported in Adobe Flash Player...

SuSE 10 Security Update : flash-player (ZYPP Patch Number 8395)

This version upgrade of flash-player fixes multiple unspecified code execution vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid63279;...

Google Chrome < 23.0.1271.97 Multiple Vulnerabilities

Binary data 6643.pasl...

RHEL 5 / 6 : flash-plugin (RHSA-2012:1569)

An updated Adobe Flash Player package that fixes three security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CVE-2012-5678

CVE-2012-5678 concerns Adobe Flash Player (and related AIR components) with multiple memory-corruption and code-execution vulnerabilities across Windows, Mac, Linux and Android platforms. Affected versions include Flash Player before 10.3.183.48 / 11.x before 11.5.502.135 on Windows, Mac, Linux; ...

Flash Player <= 10.3.183.43 / 11.5.502.110 Multiple Vulnerabilities (APSB12-27)

According to its version, the instance of Flash Player installed on the remote Windows host is 11.x equal to or earlier than 11.5.502.110, or 10.x equal to or earlier than 10.3.183.43. It is, therefore, potentially affected by multiple vulnerabilities : - An unspecified error exists that can allo...

Flash Player for Mac <= 10.3.183.43 / 11.5.502.110 Multiple Vulnerabilities (APSB12-27)

According to its version, the instance of Flash Player installed on the remote Mac OS X host is 11.x equal to or earlier than 11.5.502.110, or 10.x equal to or earlier than 10.3.183.43. It is, therefore, potentially affected by multiple vulnerabilities : - An unspecified error exists that can all...

Adobe AIR 3.x <= 3.5.0.600 Multiple Vulnerabilities (APSB12-27)

According to its version, the instance of Adobe AIR 3.x on the remote Windows host is 3.5.0.600 or earlier. It is, therefore, reportedly affected by multiple vulnerabilities : - An unspecified error exists that can allow a buffer overflow and arbitrary code execution. CVE-2012-5676 - An unspecifi...