WordPress Ultimate Product Catalogue 3.1.2 XSS / CSRF / File Upload Vulnerabilities

WordPress Ultimate Product Catalogue plugin version 3.1.2 suffers from cross site request forgery, cross site scripting, and file upload vulnerabilities. Exploit Title: Multiple Persistent XSS & CSRF & File Upload on Ultimate Product Catalogue 3.1.2 Google Dork: inurl:"SingleProduct" intext:"Back...

Apple Mac OS X .sgi File Memory Corruption Vulnerability

Apple Mac OS X is an operating system developed by Apple Inc. A memory corruption vulnerability exists in Apple Mac OS X's handling of .sgi files, which allows attackers to exploit the vulnerability to construct malicious files that can be parsed by the user and can be used to execute arbitrary...

Foxit Reader < 7.1 Cloud Plugin Windows Search Path Vulnerability

Foxit Reader Cloud Plugin is prone to a windows search path vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Threat warning: a lot of ubnt devices is Backdoor-vulnerability warning-the black bar safety net

This article elaborated: the discovery of a hacker attack, intrusion analysis, counter hack Server, successfully obtain permission and complete evidence of the whole process. Such an invasion is now also very much, especially for a specific system of orientation, but“blind scan”in the attack...

Apache Batik Information Disclosure Vulnerability

Apache Batik is a Java-based technology SVG Scalable Vector Graphics toolkit , you can view , generate and process SVG format images . Apache Batik has a security vulnerability that can be exploited by attackers to send malicious SVG files and obtain sensitive information...

Microsoft Windows Photo Decoder Sensitive Memory Information Disclosure Vulnerability

Microsoft Windows Photo Decoder is a picture decoding program. A security vulnerability in Microsoft Windows Photo Decoder's handling of PEG XR .JXR files allows attackers to exploit the vulnerability to construct malicious files that can be parsed by the user and can be used to obtain sensitive...

pngcrush Remote Code Execution Vulnerability

pngcrush is an image optimization and compression tool. A security vulnerability exists in pngcrush that allows an attacker to exploit the vulnerability to construct malicious files that can be induced to be parsed by the application, which can crash the application or execute code...

Invoking Mozilla updater will load locally stored DLL files — Mozilla

Security researcher Holger Fuhrmannek reported that when the Mozilla updater is run directly, the updater will load binary DLL format files from the local working directory or from the Windows temporary directories. This occurs when it is run without the Mozilla Maintenance Service on Windows...

FFmpeg2 Out-of-Bounds Denial of Service Vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video. FFmpeg suffers from an out-of-bounds denial-of-service vulnerability that allows attackers to exploit the vulnerability to construct malicious files and trick users into parsing them, which can crash the...

Unspecified Type Obfuscation Vulnerability in Adobe Flash Player

Adobe Flash Player is a Flash file handling program. An unspecified type obfuscation vulnerability exists in Adobe Flash Player, which allows attackers to construct malicious SWF files that can be tricked into parsing by a user, which can then be used in an application context to execute arbitrar...

Pigz directory traversal vulnerability

pigz is a compression processing tool. A directory traversal vulnerability exists in pigz that allows remote attackers to construct malicious files and trick users into parsing them, which can overwrite system directory files...

Multiple Vulnerabilities in VLC Media Player

VLC Media Player is a popular multimedia playback program. VLC Media Player contains multiple unspecified vulnerabilities that could be exploited by attackers to construct malicious files that could be parsed by users, which could crash the application or execute code...

BSDCPIO Symbolic Link Directory Traversal Vulnerability

BSDCPIO is a packaging tool. A directory traversal vulnerability exists in the BSDCPIO symbolic link, which allows an attacker to build malicious files and trick applications into processing them, which can be used to obtain sensitive information...

NotePad++ Buffer Overflow Vulnerability

NotePad++ is an open source editor that runs in the Windows environment and supports multiple programming languages. NotePad++ suffers from a buffer overflow vulnerability that allows remote attackers to exploit the vulnerability to construct malicious files and trick users into parsing them, whi...

clamav: denial of service

It was discovered that clamav crashes on certain files when using 'clamscan -a' or while scanning maliciously crafted files...

Security Advisory-File Upload Vulnerability on Huawei Honor Cube Wireless Router WS860s

Huawei Honor Cube wireless router WS860s supports the file upload function. It allows users to access its files through the web page. As the device is unable to verify every type of file to be uploaded and does not strictly restrict the file access path through the web page, attackers may upload...

CNIL CookieViz Cross Site Scripting / SQL Injection Vulnerabilities

CNIL CookieViz suffers from cross site scripting and remote SQL injection vulnerabilities. CNIL CookieViz XSS + SQL injection leading to user pwnage Product link: https://github.com/LaboCNIL/CookieViz CVE references CVE-2014-8351, CVE-2014-8352 TL;DR ----- Since October 2014, the French National...

Arbitrary File Upload in HelpDEZk

High-Tech Bridge Security Research Lab discovered vulnerability in HelpDEZk, which can be exploited to compromise vulnerable web site. 1 Unrestricted Upload of File with Dangerous Type in HelpDEZk: CVE-2014-8337 The vulnerability exists due to absence of validation of file extensions when uploadi...

Cisco AsyncOS Software ZIP Filtering Bypass Vulnerability

A vulnerability in the ZIP inspection engine of Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the engine protection and deliver malicious ZIP files. The vulnerability is due to improper implementation of the logic for analyzing the...

Advantech WebAccess bwocxrun ActiveX Control Installation Vulnerability

This vulnerability allows remote attackers to install certain ActiveX controls without user interaction on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The...