Google Broadens Scope of Unwanted Software Warnings

Google yesterday announced that it would expand its browser security efforts with a new warning in Chrome about unwanted software to caution users about accessing sites that are known to encourage unsafe downloads. The Mountain View, Calif., search and browsing giant has invested serious resource...

Critical Remote Code Execution Flaw Found in WordPress Plugin

There is an easily exploitable remote code execution vulnerability in a popular WordPress plugin that helps manage file downloads and researchers say the bug could be used by even a low-level attacker to run arbitrary code on a vulnerable site. The vulnerability is in the WP Download Manager,...

GREED 0.81 GRX File List Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12034/info greed Get and Resume Elite Edition is prone to unauthorized command execution. This issue is exposed when the application processes a GRX file list that specifies shell metacharacters and commands in file names...

Cisco Unity Connection Directory Traversal Vulnerability

A vulnerability in the messaging API of Cisco Unity Connection could allow an authenticated, remote attacker to execute a directory traversal and download arbitrary files that match the allowed MIME types. The vulnerability occurs because there is insufficient input filtering and file types other...

Google Blocks Malicious File Downloads Automatically in Chome

Google has fixed five vulnerabilities in its Chrome browser and also has activated a feature that will block malicious file downloads automatically. The change is a major security upgrade for Chrome and will help prevent users from unwittingly downloading harmful files, an attack vector that...

Out-of-bounds

Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service out-of-bounds read via vectors related to a "user gesture check for dangerous file downloads."...

CVE-2013-0888

Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service out-of-bounds read via vectors related to a "user gesture check for dangerous file downloads."...

CVE-2013-0888

Removed by vendor...

Google Chrome < 25.0.1364.97 Multiple Vulnerabilities

Binary data 800930.prm...

Google Chrome < 25.0.1364.97 Multiple Vulnerabilities

Binary data 6694.pasl...

Scientific Linux Security Update : curl on SL4.x, SL5.x, SL6.x i386/x86_64

cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that cURL always performed credential delegation when authenticating with GSSAPI. A rogue server could use this flaw to obtain the...

Design/Logic Flaw

Google Chrome before 15.0.874.102 does not properly handle downloading files that have whitespace characters at the end of a filename, which has unspecified impact and user-assisted remote attack vectors...

South Korean UTW CMS Disclosure / Local File Inclusion / CSRF

Exploit Title: South Korean UTW CMS Multiple Vulnerabilities Date: 18.11.2010 Author: Valentin Category: webapps/0day Version: Tested on: CVE : Code : :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Title = South Korean UTW CM...

Sandbox 2.0.3 Bypass / Local File Inclusion / Shell Upload / SQL Injection

Sandbox 2.0.3 Multiple Remote Vulnerabilities Name Sandbox Vendor http://www.iguanadons.net Versions Affected 2.0.3 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-07 X. INDEX I. ABOUT THE APPLICATION II...

[slackware-security] pidgin

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2010-0013 Here are the details from the Slackware 13.0...

CVE-2008-7011

The Unreal engine, as used in Unreal Tournament 3 1.3, Unreal Tournament 2003 and 2004, Dead Man's Hand, Pariah, WarPath, Postal2, and Shadow Ops, allows remote authenticated users to cause a denial of service server exit via multiple file downloads from the server, which triggers an assertion...

Apache < 2.2.12 Multiple Vulnerabilities

Binary data 5111.prm...

pidgin: unrestricted download of arbitrary files triggered via UPnP

The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service memory or disk consumption via a UDP packet that specifies an arbitrary URL...

JBossEAP allows download of non-EJB class files

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

CVE-2008-3879

The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destinati...