Directory traversal

SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside th...

Deserialization of untrusted data

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch...

CVE-2019-7213

SmarterTools SmarterMail 16.x before build 6985 is affected by a directory traversal vulnerability. An authenticated user could delete arbitrary files or create files in new folders on the mail server, potentially leading to command execution if those files are placed in web directories. Root cau...

CVE-2019-7213

SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside th...

CVE-2019-7212

SmarterTools SmarterMail 16.x before build 6985 is affected by a hardcoded secret key vulnerability that enables an unauthenticated actor to access other users’ emails and file attachments and to interact with mailing lists. Root cause: hardcoded credentials in the product. Affected component: Sm...

CVE-2019-7212

SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. It was also possible to interact with mailing lists...

PT-2019-18466 · Smartertools · Smartermail

Name of the Vulnerable Software and Affected Versions: SmarterTools SmarterMail versions prior to build 6985 Description: The issue allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not...

CVE-2019-6985

An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-of-Bounds Read in Indexing or a Heap Overflow and crash during handling of certain PDF files that embed specifically crafted 3D content, due to an array acces...

CVE-2019-6985

CVE-2019-6985 affects Foxit 3D Plugin Beta prior to 9.4.0.16807 for Foxit Reader/PhantomPDF. The issue is an out-of-bounds read in Indexing or a heap overflow caused by an array access violation when handling PDF files that embed crafted 3D content, leading to a crash. No exploitation details are...

CVE-2018-6985

This CVE-2018-6985 entry is rejected/not used and does not represent an active vulnerability.

CVE-2017-6985

CVE-2017-6985 affects macOS Sierra and earlier, with a memory corruption issue in NVIDIA Graphics Drivers that can allow local attackers to execute arbitrary code in kernel context or cause a denial of service via a crafted app. Apple addresses this in macOS 10.12.5 (Security Update 2017-002) for...

Updated flash-player-plugin package fixes security vulnerabilities

Adobe Flash Player 11.2.202.637 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This update resolves a type confusion vulnerability that could lead to code execution CVE-2016-6992. This...

Memory corruption

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-4273,...

CVE-2016-6985

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-4273,...

CVE-2016-6985

Adobe Flash Player CVE-2016-6985 is a memory corruption vulnerability affecting Windows/OS X and Linux builds (before 18.0.0.382; 19.x up to 23.x before 23.0.0.185 on Windows/macOS; before 11.2.202.637 on Linux) triggered by parsing of SWF content as described by the PSP and related advisories. T...

SUSE SLED12 Security Update : flash-playerqemu (SUSE-SU-2016:2512-1)

flash-player was updated to version 11.2.202.637 to fix the following issues bsc1004019 : - CVE-2016-6992: A type confusion vulnerability that could lead to code execution. CVE-2016-6981, CVE-2016-6987: use-after-free vulnerabilities that could lead to code execution CVE-2016-4286: Security bypas...

CVE-2016-6985

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-4273,...

Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt66

Oct. 12, 2016 Sergey V Turchin 3:11-alt66 - new version - security fixes: CVE-2016-4273, CVE-2016-4286, CVE-2016-6981, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6987, CVE-2016-6989, CVE-2016-6990, CVE-2016-6992...

CVE-2015-6985

CVE-2015-6985 affects Apple Type Services (ATS) in macOS OS X before 10.11.1. A crafted web page can remotely trigger memory corruption, leading to arbitrary code execution or application crash. The issue is the result of a memory-handling flaw in ATS. Apple released OS X 10.11.1 (Security Update...

CVE-2014-6985

The CVE-2014-6985 entry concerns the Georgia Packing Android app (version 3.9.16). The vulnerability is due to the app not verifying X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive information via a crafted certificate. The connected...