libming denial of service vulnerability (CNVD-2017-34968)

libming is a Flash SWF output library written in C for use in systems developed in PHP, Perl, etc. It can be used to output Flash SWF files to the system. A denial of service vulnerability exists in the 'outputSWFTEXTRECORD' function in the util/outputscript.c file in libming 0.4.8 and earlier...

UBUNTU-CVE-2017-16883

The outputSWFTEXTRECORD function in util/outputscript.c in libming = 0.4.8 is vulnerable to a NULL pointer dereference, which may allow attackers to cause a denial of service via a crafted swf file...

Catalyst Mahara Cross-Site Scripting Vulnerability (CNVD-2017-36189)

Catalyst Mahara is a social networking system from Catalyst IT in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Catalyst Mahara. An attacker can exploit this vulnerability by maliciously creating a .swf file to execute code whe...

bankcomm.com.hk XSS vulnerability

Open Bug Bounty ID: OBB-353308 Description| Value ---|--- Affected Website:| bankcomm.com.hk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Adobe Flash Player Remote Memory Corruption Code Execution Vulnerability

Adobe Flash Player is a multimedia program player. A memory corruption vulnerability exists in Adobe Flash Player's handling of SWFs, which could be exploited by remote attackers to submit a specially crafted SWF file and trick the user into parsing it, which could crash the application or execut...

GSA Bounty: Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's host

We endorse sp1d3rs's summary! The PR fixing this ticket is here: https://github.com/18F/federalist/pull/1157 Thanks to the 18F team for the great experience, fast fix, and the bounty! The report details i requested the limited disclosure due to lot of sensitive info in the attachments and report...

Linux kernel elevation of privilege vulnerability (CNVD-2017-243541)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the 'sanitycheckrawsuper' function in the fs/f2fs/super.c file in versions of Linux kernel prior to 4.11.1. A local attacker could exploit...

DEBIAN-CVE-2017-10663

The sanitycheckckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors...

Core Arbitrary File Upload Vulnerability

Joomla! is an open source, cross-platform content management system CMS developed using PHP and MySQL. An arbitrary file upload vulnerability exists in Joomla! Core. A low-privileged user is allowed to upload swf files...

CVE-2017-7852

D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to , thus accepting requests from any domain. If a...

euroads.dk XSS vulnerability

Vulnerable URL: http://euroads.dk/mediafiles/ea/dk/flash/no-EuroAds-Annoncoer.swf?clickTag=javascript:alert%27OPENBUGBOUNTY%27 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 123505...

frederiksenarchitects.dk XSS vulnerability

Vulnerable URL: http://www.frederiksenarchitects.dk/files/images/Flashknapper/88dcf9.swf?clickTAG=javascript:alert%27OPENBUGBOUNTY%27 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

UBUNTU-CVE-2017-7578

Multiple heap-based buffer overflows in parser.c in libming 0.4.7 allow remote attackers to cause a denial of service listswf application crash or possibly have unspecified other impact via a crafted SWF file. NOTE: this issue exists because of an incomplete fix for CVE-2016-9831...

UBUNTU-CVE-2016-9831

Heap-based buffer overflow in the parseSWFRGBA function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to have unspecified impact via a crafted SWF file...

RTMPDump: Multiple vulnerabilities

Background RTMPDump is an RTMP client intended to stream audio or video flash content Description Multiple vulnerabilities have been discovered in RTMPDump. The following is a list of vulnerabilities fixed: Additional decode input size checks Ignore zero-length packets Potential integer overflow ...

WordPress Cross-Site Request Forgery Vulnerability (CNVD-2017-00616)

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress versions prior to 4.7.1. A remote attacker can...

CVE-2017-5489

Cross-site request forgery CSRF vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload...

CVE-2017-5489

Cross-site request forgery CSRF vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload...

CVE-2017-5489

CVE-2017-5489 affects WordPress before 4.7.1. It is a CSRF vulnerability that allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload. The impact is the hijack of user authentication with potential for unauthorized actions. WordPress p...