Google Chrome < 72.0.3626.81 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 72.0.3626.81. It is, therefore, affected by multiple vulnerabilities as referenced in the 201901stable-channel-update-for-desktop advisory. - Missing URI encoding of untrusted input in DevTools in Google Chrome prior to...

CVE-2018-11620

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Design/Logic Flaw

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-11620

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-11620

CVE-2018-11620 affects Foxit Reader (up to version 9.0.1.1049) with an out-of-bounds read in ConvertToPDF_x86.dll caused by insufficient validation of user-supplied data. This can disclose sensitive information and, in conjunction with other vulnerabilities, may enable arbitrary code execution in...

CVE-2018-5756

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...

CVE-2018-5756

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...

CVE-2018-5756

The CVE-2018-5756 advisory concerns the Open-Xchange OX App Suite backend. It states that the backend does not properly verify folder-to-object associations, enabling remote authenticated users to delete arbitrary tasks by supplying the task ID in a delete action to api/tasks. Affected are Open-X...

OX App Suite 7.8.4 - Multiple Vulnerabilities

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 55872 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.8.4 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.3-rev30, 7.8.2-rev3...

OX App Suite 7.8.4 XSS / Privilege Management / SSRF / Traversal

Dear subscribers, we've migrated our public disclosure workflow to full-disclosure and are catching up on publishing recent vulnerabilities through this channel. Feel free to join our bug bounty programs open-xchange, dovecot, powerdns at HackerOne. Yours sincerely, Martin Heiland, Open-Xchange...

CVE-2016-5756

NetIQ Access Manager is affected by CVE-2016-5756: multiple web tools components are vulnerable to Reflected Cross-Site Scripting, enabling potential session hijack. Vulnerable in NAM 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2; affected endpoints include nps/servlet/frameservice, nps/servlet...

CVE-2015-5756

The CVE-2015-5756 entry concerns Apple FontParser in iOS before 8.4.1 and OS X before 10.10.5. The issue is a memory corruption vulnerability triggered by processing crafted font files, enabling remote arbitrary code execution or a denial of service (application crash). Connected documents corrob...

CVE-2014-5756

The CVE-2014-5756 entry concerns the Android app “Buy 99 Cents Only Products” (com.ww99CentsOnlyStores) version 0.1, which does not validate X.509 certificates when connecting to SSL servers. This creates a susceptibility to man-in-the-middle attacks where a crafted certificate can spoof servers ...

CVE-2013-5756

The provided sources confirm CVE-2013-5756 affects Yealink VoIP Phone SIP-T38G via a directory traversal in the web interface (cgi-bin/cgiServer.exx). An authenticated remote attacker can read arbitrary files by supplying a crafted …/ page parameter, enabling access to sensitive files such as /et...

Yealink VoIP Phone SIP-T38G - Local File Inclusion

No description provided by source. Title: Yealink VoIP Phone SIP-T38G Local File Inclusion Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5756, CVE-2013-5757 Description: Web interface...

Yealink VoIP Phone SIP-T38G Local File Inclusion

Title: Yealink VoIP Phone SIP-T38G Local File Inclusion Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5756, CVE-2013-5757 Description: Web interface contain a vulnerability that allow any...

Yealink VoIP Phone SIP-T38G - Local File Inclusion

Title: Yealink VoIP Phone SIP-T38G Local File Inclusion Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5756, CVE-2013-5757 Description: Web interface contain a vulnerability that allow any...

Yealink VoIP Phone SIP-T38G - Local File Inclusion

Yealink VoIP Phone SIP-T38G - Local File Inclusion Title: Yealink VoIP Phone SIP-T38G Local File Inclusion Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5756, CVE-2013-5757 Description: We...

CVE-2008-5756

The CVE-2008-5756 issue affects BreakPoint Software Hex Workshop 5.1.4. A buffer overflow occurs when parsing a Color Mapping (.cmap) file due to a long mapping reference, enabling user-assisted DoS and potentially arbitrary code execution. Connected sources corroborate a Denial of Service path v...

SuSE 10 Security Update : libxml2 (ZYPP Patch Number 5756)

This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. CVE-2008-4226 Thanks to: Drew Yao of Apple Product Security %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...