4961 matches found
CVE-2016-4295
When opening a Hangul Hcell Document .cell and processing a particular record within the Workbook stream, an index miscalculation leading to a heap overlow can be made to occur in Hancom Office 2014. The vulnerability occurs when processing data for a formula used to render a chart via the...
CVE-2016-4292
When opening a Hangul HShow Document .hpt and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer yet explicitly trust a size from the file when modifying data inside of it. Due to this, an aggressor can corrupt memory outside the bounds...
ghostscript: .libfile does not honor -dSAFER
It was found that ghostscript function .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could, in the context of the gs process, retrieve file content on the target machine...
ghostscript: getenv and filenameforall ignore -dSAFER
It was found that the ghostscript functions getenv and filenameforall did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable and list directory respectively, fro...
ghostscript: .libfile does not honor -dSAFER
It was found that ghostscript function .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could, in the context of the gs process, retrieve file content on the target machine...
Box.com Plugs Account Data Leakage Flaw
Box.com has changed the way it handles publicly shared accounts and folders after a researcher found confidential documents and data belonging to Box.com users via Google, Bing and other search engines. While Box.com maintains this is a case of its customers unintentionally over-sharing, it says ...
Uber: IDOR on partners.uber.com allows for a driver to override administrator documents
An IDOR in the /p3/drivers/uploadDocument endpoint on partners.uber.com allowed a driver to upload and overwrite documents for other drivers on a multi-driver account. In addition to this, there was an access control issue where a driver account could also upload and overwrite documents for the...
Microsoft Edge Access Disclosure
The vulnerability of Microsoft Edge relates to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to gain access to the “My Documents” folder through a specially crafted web page...
CVE-2016-5851
python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...
CVE-2016-7265
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to obtain sensitive information from process...
CVE-2016-7265
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to obtain sensitive information from process...
Insecure NAS Device Exposes 350 Ameriprise Investment Accounts
A trove of data belonging to Ameriprise Financial was found earlier this month that included Social Security numbers, decryption keys and confidential internal company documents. The breach is related to the use of a network attacked storage device that insecurely backed up data from an internal...
CVE-2016-6842
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed...
CVE-2016-4047
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions .dtd resources can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker...
CVE-2016-4047
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions .dtd resources can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker...
PT-2016-7135
Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue allows malicious script code to be executed within a user's context when a shared "Templates" folder is accessed from OX Documents settings. This occurs if the user's...
Microsoft Office DoS
The vulnerability of the Microsoft Office suite is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service interruptions through the use of specially crafted documents...
CVE-2016-6842: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed...
Mozilla: Crash in EnumerateSubDocuments (MFSA 2016-94, MFSA 2016-95)
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR 45.6 and Thunderbird 45.6...
