Cross-site Scripting Vulnerability in TreeHole Outbound Linking System

Treehole external chain system is a free and open source PHP external chain network disk system, support for seven cattle, local, remote three kinds of storage methods, support for multi-user system. Treehugger external link system in shudong\includes\save file cross-site scripting vulnerability ...

SUSE-SU-2017:1627-1 Security update for sudo

This update for sudo fixes the following issues: - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. bsc1042146 Also the following non security bug was fixed: -...

max.linkingmobile.com XSS vulnerability

Vulnerable URL: https://max.linkingmobile.com/trackid/filenotfound.php?code=%3Csvg/onload=alert/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Microsoft Windows OLE Remote Code Execution Vulnerability (CNVD-2017-09716)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A remote code execution vulnerability exists in the olecnv32.dll file in Microsoft Windows due to Windows OLE failing to properly filter user input. A remote attacker can exploit this vulnerability to...

SQL injection vulnerability in the save.php file of TreeHole's external link system

TreeHole Outbound Linking System is a free and open source outbound linking system. Treehole external link system save.php file SQL injection vulnerability , the vulnerability stems from x-forwarded-for failure to adequately filter , an attacker can exploit the vulnerability to access or modify...

CVE-2017-0211

An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 versions of Microsoft Windows OLE when it fails an integrity-level check, aka "Windows OLE Elevation of Privilege Vulnerability."...

Microsoft Office Word OLE Object Code Execution Vulnerability

Microsoft Office is a popular office software suite developed by Microsoft. A code execution vulnerability exists in the Microsoft Office Word OLE object, which can be exploited by an attacker to obtain permission to remotely execute arbitrary code, covertly install a variety of malware, and infe...

Cross-site Scripting (XSS)

marked is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript via the linking function...

[SECURITY] Fedora 24 Update: w3m-0.5.3-27.git20161120.fc24

The w3m program is a pager or text file viewer that can also be used as a text-mode Web browser. W3m features include the following: when reading an HTML document, you can follow links and view images using an external image viewer; its internet message mode determines the type of document from t...

Starbucks: Starbucks.com is reachable via ip address thus possible to link any doamin to Starbucks.

It is possible for anybody to buy a domain name containing negative terms and point it to someone's website in order to damage their reputation. For instance someone could buy the domain child-pornography.com and point it to the address 107.162.135.91 which is the address behind starbucks.com To...

[SECURITY] Fedora 25 Update: libpng10-1.0.67-1.fc25

The libpng10 package contains an old version of libpng, a library of functi ons for creating and manipulating PNG Portable Network Graphics image format files. This package is needed if you want to run binaries that were linked dynamic ally with libpng 1.0.x...

PT-2017-2447 · Ruby · Ruby

Name of the Vulnerable Software and Affected Versions: Ruby affected versions not specified Description: The issue is related to type confusion in the WIN32OLE class of Ruby, specifically in the ole invoke and ole query interface methods. This occurs when an attacker passes a different type of...

Harvest: Editing a project (LIMITED)

Hey there, I found out that invited user to a project cannot edit the project settings unless he is a PROJECT MANAGER on it. Now there is an option while editing project to make it BILLABLE OR NOT... When it is NOT billable it is quite impossible to BILL an invoice for it without making it...

Harvest: Linking Invoice to uninvited project.

Hey there, I found that an project manager can link his/her invoice to an project where he/she is uninvited. While linking the invoice an request is sent : POST /invoices/10877569 HTTP/1.1 Host: hshteam.harvestapp.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:49.0 Gecko/20100101...

CVE-2016-3375

The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote attackers to...

Fedora 24 : nfdump (2016-a771d67ba0)

nfdump 1.6.15 released. --- - Fix Security issue http://www.security-assessment.com/files/documents/advis ory/Nfdump%20nfcapd%201.6.14%20-%20Multiple%20Vulnerabil ities.pdf - Fix obyte, opps and obps output records - Fix wrong bps type case in cvs output. Fix opbs ipbs typos nfdump 1.6.14 release...

Fedora 22 : nfdump (2016-3b49c9aa49)

nfdump 1.6.15 released. --- - Fix Security issue http://www.security-assessment.com/files/documents/advis ory/Nfdump%20nfcapd%201.6.14%20-%20Multiple%20Vulnerabil ities.pdf - Fix obyte, opps and obps output records - Fix wrong bps type case in cvs output. Fix opbs ipbs typos nfdump 1.6.14 release...

Fedora 23 : nfdump (2016-54dfd21f15)

nfdump 1.6.15 released. --- - Fix Security issue http://www.security-assessment.com/files/documents/advis ory/Nfdump%20nfcapd%201.6.14%20-%20Multiple%20Vulnerabil ities.pdf - Fix obyte, opps and obps output records - Fix wrong bps type case in cvs output. Fix opbs ipbs typos nfdump 1.6.14 release...

The vulnerability of the Windows operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in Windows OLE allows for the execution of code remotely, provided that the user opens a file containing a specially crafted OLE object. Exploiting this vulnerability enables the attacker to gain privileges similar to those of an authorized user. If the accessing user has...

The vulnerability of the Windows operating system, which allows a hacker to bypass the ASLR protection mechanism

The vulnerability of the dynamically linked GDI32.dll library of the Windows operating system’s Graphics component is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass the ASLR protection mechanism...