CVE-2017-11694

MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with Apache Solr may be able to obtain or modify sensitive patient and financial information. T...

Microsoft Office Outlook Arbitrary Code Execution Vulnerability (CNVD-2017-18936)

Microsoft Outlook is an e-mail client software bundled with the Office suite from Microsoft USA. The software manages e-mail, contacts, calendars, and more. An arbitrary code execution vulnerability exists in Microsoft Outlook. A remote attacker can exploit this vulnerability to execute arbitrary...

Microsoft Office Outlook Arbitrary Code Execution Vulnerability

Microsoft Outlook is an e-mail client software bundled with the Office suite from Microsoft USA. The software manages e-mail, contacts, calendars, and more. An arbitrary code execution vulnerability exists in Microsoft Outlook. A remote attacker can exploit this vulnerability to execute arbitrary...

3 New CIA-developed Hacking Tools For MacOS & Linux Exposed

WikiLeaks has just published a new set of classified documents linked to another CIA project, dubbed 'Imperial,' which reveals details of at least three CIA-developed hacking tools and implants designed to target computers running Apple Mac OS X and different flavours of Linux operating systems. ...

DEBIAN-CVE-2017-9740

The xpsdecodefontcharimp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified other impact via a crafted document...

[SECURITY] Fedora 25 Update: libmwaw-0.3.12-1.fc25

libmwaw is a library for import of old Mac documents. It supports many kinds of text documents, spreadsheets, databases, vector and bitmap images. Supported are, for example, documents created by BeagleWorks, ClarisWorks, MacPaint, MacWrite or Microsoft Word for Mac. A full list of supported...

Nitro Pro PDF - Multiple Vulnerabilities

Nitro Pro PDF - Multiple Vulnerabilities Vulnerabilities Summary The following advisory describes three vulnerabilities found in Nitro / Nitro Pro PDF. Nitro Pro is the PDF reader and editor that does everything you will ever need to do with PDF files. The powerful but snappy editor lets you chan...

OpenJDK: insecure XML parsing in wsdlimport (JAX-WS, 8182054)

It was discovered that the wsdlimport tool in the JAX-WS component of OpenJDK did not use secure XML parser settings when parsing WSDL XML documents. A specially crafted WSDL document could cause wsdlimport to use an excessive amount of CPU and memory, open connections to other hosts, or leak...

UBUNTU-CVE-2017-9765

Integer overflow in the soapget function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow and application crash via a large XML document, aka Devil'...

Oracle E-Business Suite Flaw Allows Downloads of Documents

Oracle admins have more than 300 patches to contend with today, but one that should be considered a top priority is a bug in the E-Business Suite of business applications that could allow an attacker to download data without the need for authentication. The vulnerability, CVE-2017-10244, was...

CVE-2017-7664

Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0...

Code injection

Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0...

Xxe

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

CVE-2017-1000021: Improper Restriction of XML External Entity Reference

LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents...

PT-2017-17870

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 3.1.0 through 3.2.x Description The issue arises from the incorrect validation of uploaded XML documents. The estimated number of potentially affected devices worldwide is not available. There is no information abo...

CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

CVE-2017-1000021

LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents...

PT-2017-10733

Name of the Vulnerable Software and Affected Versions LogicalDoc Community Edition versions 7.5.3 and prior Description The issue allows for an XSS attack when the preview function is used on HTML documents. Recommendations For versions 7.5.3 and prior, update to a version that contains a fix for...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds. An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting i...

Microsoft WordPad Remote Code Execution Vulnerability

Microsoft Windows is a popular computer operating system. Microsoft Windows Wordpad has a security vulnerability in the parsing of constructed documents that could be exploited by an attacker to submit a special file that crashes the application or executes arbitrary code...