CVE-2016-1771: Undefined Security Weakness

The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site...

PT-2016-1537

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 9.1 Description The issue is related to the incorrect handling of file expansion in the Downloads feature of Apple Safari, allowing remote attackers to cause a denial of service via a specially crafted web site...

Apple Safari Safari Downloads Denial of Service Vulnerability

Apple Safari is a web browser from Apple and is the default browser that comes with the Mac OS X and iOS operating systems.Safari Downloads is one of the download management plug-ins available. A security vulnerability exists in Safari Downloads in versions of Apple Safari prior to 9.1. The...

CVE-2016-1991

HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to conduct unspecified "file download" attacks via unknown vectors...

FreeBSD : PuTTY - old-style scp downloads may allow remote code execution (7f0fbb30-e462-11e5-a3f3-080027ef73ec)

Simon G. Tatham reports : Many versions of PSCP prior to 0.67 have a stack corruption vulnerability in their treatment of the 'sink' direction i.e. downloading from server to client of the old-style SCP protocol. In order for this vulnerability to be exploited, the user must connect to a maliciou...

WordPress Easy Digital Downloads Plugin <= 2.5.7 - PHP Object Injection

Because of this vulnerability, attackers can execute arbitrary PHP code. Solution Upgrade the plugin...

Putty 0.66 DLL Hijacking

Hi, putty-0.66-installer.exe loads and executes DWMAPI.dll or UXTheme.dll from its "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and for "prior art" about this well-known and well-documented...

Easy Digital Downloads <= 2.5.7 - PHP Object Injection

Easy Digital Downloads unserializes user-submitted data from cookies and other request parameters, allowing for object injection...

GIMP For Windows DLL Hijacking

Hi @ll, the executable installer gimp-2.8.16-setup-1.exe and of course older versions too available from loads and executes UXTheme.dll from its "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and...

Cygwin DLL Hijacking

Hi @ll, Cygwin's setup-x86.exe loads and executes UXTheme.dll on Windows XP also ClbCatQ.dll and some more DLLs from its "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and If UXTheme.dll or one of...

The software of the Advantech WebAccess remote monitoring system is vulnerable, allowing a intruder to modify files of any type.

The vulnerability of Advantech WebAccess remote monitoring software lies in the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to modify files of any type remotely...

Ubuntu 14.04 LTS : Firefox regression (USN-2880-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2880-2 advisory. USN-2880-1 fixed vulnerabilities in Firefox. This update introduced a regression which caused Firefox to crash on startup with some configurations. This update...

CVE-2016-1947

Mozilla Firefox 43.x mishandles attempts to connect to the Application Reputation service, which makes it easier for remote attackers to trigger an unintended download by leveraging the absence of reputation data...

Mozilla Firefox Application Reputation Service Vulnerability (Jan 2016) - Windows

Mozilla Firefox is prone to application reputation service disabling vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mozilla Firefox Application Reputation Service Vulnerability (Jan 2016) - Mac OS X

Mozilla Firefox is prone to an application reputation service disabling vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

UBUNTU-CVE-2016-1947

Mozilla Firefox 43.x mishandles attempts to connect to the Application Reputation service, which makes it easier for remote attackers to trigger an unintended download by leveraging the absence of reputation data...

Python 3.5.1 DLL Hijacking

Hi @ll, the executable installers python-3.5.1-webinstall.exe and python-3.5.1.exe available on load and execute multiple DLLs from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and for "pri...

CVE-2015-7706

Multiple cross-site scripting XSS vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to api/v3/public/shares/downloads/, the 2 authType parameter to api/v3/auth/login, or the 3 login parameter to...

PT-2016-3827

Name of the Vulnerable Software and Affected Versions Secure Data Space SDS-API versions prior to 3.5.7 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This can be achieved through the "PATH INFO" to...

TrueCrypt 7.1a / 7.2 DLL Hijacking

Hi @ll, the executable installers "TrueCrypt Setup 7.1a.exe" and TrueCrypt-7.2.exe load and execute USP10.dll, RichEd20.dll, NTMarta.dll and SRClient.dll from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads"...