AXIS Authenticated 远程命令执行漏洞

来源：packetstormsecurity Technical Details The devtools.sh script is the responsible for vulnerability and it's 4 attack vectors through the following pages: http://xxx.xxx.xxx.xxx/applicense.shtml?app= http://xxx.xxx.xxx.xxx/applicensecustom.shtml?app= http://xxx.xxx.xxx.xxx/appindex.shtml?app=...

Silurus Classifieds 2.0 Cross Site Scripting

Title: Silurus Classifieds XSS Vulnerability Software : Silurus Classifieds Software Version : v2.0 Vendor: http://snowhall.com/slides/silurus Vulnerability Published : 2016-07-25 Author：zhiweijiang Email:[email protected] Impact : MediumCVSS2 Base : 4.3, AV:N/AC:M/Au:N/C:N/I:P/A:N Bug...

[SECURITY] Fedora 23 Update: kf5-karchive-5.24.0-1.fc23

KDE Frameworks 5 Tier 1 addon with archive functions...

[SECURITY] Fedora 24 Update: kf5-karchive-5.24.0-1.fc24

KDE Frameworks 5 Tier 1 addon with archive functions...

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

It was discovered that the pnggetPLTE and pngsetPLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer...

Fedora 24 : gd (2016-a4d48d6fd6)

Version 2.2.2 Security related fixes : - Integer Overflow in gdImagePaletteToTrueColor resulting in heap overflow CVE-2016-5767 - Stack overflow with gdImageFillToBorder CVE-2015-8874 - Integer Overflow in gd2GetHeader resulting in heap overflow CVE-2016-5766 - NULL pointer Dereference at...

Server: Disclosure of arbitrary certificate files

The 'Import root certificate' ability that users are able to use once filesexternal is enabled allows users to import their own root certificates for connections. e.g. server-to-server shares to servers using a self-signed certificate or external storages The functionality was using the PHP OpenS...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7 Extended Update Support. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detail...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability in the Auxiliary Functions Driver AFD allows for an increase in privilege levels. Exploiting this vulnerability enables a malicious individual to execute arbitrary code and gain full control over the system. After that, they can install programs, view, modify, or delete data, as...

The vulnerability of PHP software allows a malicious attacker to compromise the integrity and accessibility of protected information.

The vulnerability exists in the GD context component of PHP, due to the presence of the sequence %00 in path names. Exploiting this vulnerability allows malicious actors to overwrite arbitrary files using specially crafted input data that triggers the functions imagegd, imagegd2, imagegif,...

The vulnerability of Cisco ACS software allows a malicious individual to execute arbitrary code.

The GNU Bash command shell, as of version 4.3 and later, incorrectly handles lines that follow the declaration of a function that is exported as a variable. This allows a malicious actor to execute arbitrary code by interfering with environment variables. Security researchers have confirmed that...

CVE-2016-5230

Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and control partial module functions via a crafted app...

CVE-2016-5230

Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and control partial module functions via a crafted app...

CVE-2015-7987

Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the 1 GetValueForIPv4Addr, 2 GetValueForMACAddr, 3 rfc3110import, or 4 CopyNSEC3ResourceRecord function...

FreeXL: Multiple vulnerabilities

Background FreeXL is an open source library to extract valid data from within an Excel .xls spreadsheet. Description FreeXL’s shared strings and workbook functions are vulnerable to the remote execution of arbitrary code and Denial of Service. This can be achieved through specially crafted...

libxml2: stack overflow before detecting invalid XML file

Missing incrementation of recursion depth counter were found in the xmlParserEntityCheck and xmlParseAttValueComplex functions used for parsing XML data. An attacker could launch a Denial of Service attack by passing specially crafted XML data to an application, forcing it to crash due to stack...

Automatically Extracting Obfuscated Strings from Malware using the FireEye Labs Obfuscated String Solver (FLOSS)

Introduction and Motivation Have you ever run strings.exe on a malware executable and its output provided you with IP addresses, file names, registry keys, and other indicators of compromise IOCs? Great! No need to run further analysis or hire expensive experts to determine if a file is malicious...

[SECURITY] Fedora 23 Update: php-ZendFramework2-2.4.10-1.fc23

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

sNews CMS 1.7.1 - Multiple Vulnerabilities

sNews CMS 1.7.1 - Multiple Vulnerabilities + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SNEWS-RCE-CSRF-XSS.txt + ISR: APPARITIONSEC Vendor: ============ snewscms.com Product: ================ sNews CMS v1.7.1 Vulnerability Type:...

sNews CMS 1.7.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications + Credits: hyp3rlinx + ISR: APPARITIONSEC Vendor: ============ snewscms.com Product: ================ sNews CMS v1.7.1 Vulnerability Type: =================================== Persistent Remote Command Execution Cross Site Request Forgeries CSR...