CVE-2016-7881

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class when handling conversion to an object. Successful exploitation could lead to arbitrary code execution...

PT-2016-2957 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 23.0.0.207 and earlier Adobe Flash Player versions 11.2.202.644 and earlier Description: The issue is caused by an out-of-bounds operation in the memory buffer of the Worker class in the Flash Player platform. This...

PT-2016-2960 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 23.0.0.207 and earlier Adobe Flash Player versions 11.2.202.644 and earlier Description: The issue is caused by a buffer boundary violation in the RegExp class of the Flash Player platform. Exploitation of this iss...

VulnCheck KEV: CVE-2016-7892

Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class...

Google Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=928 Bitmap objects can be passed between processes by flattening them to a Parcel in one process and un-flattening them in another. In order to conserve memory, there exists a code path which allows Bitmaps to be shared between...

shopify-scripts: Crash: A call to Symbol.new leads to a crash when inspecting the resulting object

Calling Symbol.new leads to a when inspect is called on that method probably even more methods. From my point of view the root cause is related to 185794 the underlying boxing model. Trying the same with Ruby 2.3 will lead to a NoMethodError: undefined method 'new' for Symbol:Class, which is...

shopify-scripts: Type confusion in wrap_decimal leading to memory corruption

Decimal can be redefined, causing the Decimal class lookup in wrapdecimal to be invalid. This can lead to memory corruption or arbitrary code execution. The following snippet results in a native crash in mruby-engine olddecimal = Decimal.new1 Decimal = Hash a = -olddecimal puts a I suspect you...

WordPress Plugin Post Indexer 'classes/class.model.php' SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Post Indexer 'classes/class.model.php', which can be exploited b...

shopify-scripts: Segmentation fault when a Ruby method is invoked by a C method via Object#send

We can arrange for C to call Objectsend by aliasing it over initialize. This will cause Classnew a C function to call initialize which is actually Objectsend with arbitrary arguments. If we invoke a Ruby method through Objectsend, mruby segfaults: def foo end class X aliasmethod :initialize, :sen...

pcre: inefficient posix character class syntax check (8.38/16)

The pcrecompile function in pcrecompile.c in PCRE before 8.38 mishandles certain : nesting, which allows remote attackers to cause a denial of service CPU consumption or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object...

shopify-scripts: Range constructor type confusion DoS

It's possible to crash mruby by redefining the Range class and then using the range literal syntax: Range = Array 1..2.inspect The mrbrangenew function allocates and initializes a range object backed by the RRange struct, however it uses runtime constant lookup to find the Range class object...

CVE-2016-7239

The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-site scripting XSS attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."...

CVE-2016-7239

The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-site scripting XSS attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."...

CVE-2016-7239: Improper Neutralization of Input During Web Page Generation

The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-site scripting XSS attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."...

WordPress plugin 404 to 301 cross-site scripting vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A cross-site scripting vulnerability exists in the class-404-to-301-logs.php page of the Wordpress plugin 404 to...

Adobe Flash AVSegmentedSource Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the...

OpenJDK: insufficient classloader consistency checks in ClassLoaderWithRepository (JMX, 8157739)

A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions...

Design/Logic Flaw

Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits undefined actions to execute by default, so an attacker can use a capitalized...

WordPress: WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosure

Issue 1: Method checks if first argument is an array and if it is, it avoids the rest of the arguments and uses the first argument array values as input. Issue 2: When input query has %s in it, then it quote and this guides to sql injection in case query that need to be prepared have quoted user...

SQL Injection Vulnerability in ShowgetAdminUser Function of Tibco Call Center System

The core of Tibco's call center system is a communication-based system for internal and external corporate communication. A SQL injection vulnerability exists in the showgetAdminUser function of the Tibco Call Center System. The vulnerability file: /userweb/php/sms/sms.class.php allows attackers ...