Siemens SIMATIC WinCC and SIMATIC WinCC Runtime Professional Denial of Service Vulnerability

Siemens SIMATIC WinCC and SIMATIC WinCC Runtime Professional are industrial automation products from Siemens, Germany.SIMATIC WinCC is a Supervisory Control and Data Acquisition SCADA system.SIMATIC WinCC Runtime Professional is a visual runtime platform for operators to control and monitor...

Microsoft Internet Explorer 111 CMarkup::DestroySplayTree Use-After-Free

body background-color:black; font-color:red; ; / Exploit Title: Internet Explorer 11 CMarkup::DestroySplayTree Use-After-Free Google Dork: n/a Date: 03.05.2017 Exploit Author: Marcin Ressel TT: @resselm Vendor Homepage: www.microsoft.com Software Link: n/a Version: 11.0.9600.18638 Tested on:...

UBUNTU-CVE-2017-5464

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the DCOM application in Windows operating systems is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to enhance their privileges by using a specially created application...

Microsoft Windows HelpPane Elevation of Privilege Vulnerability

Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows HelpPane. When registering a DCOM object, the Windows COM session name does not properly implement the RunAs privilege, which can be...

UBUNTU-CVE-2017-5403

When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash. This vulnerability affects Firefox 52 and Thunderbird 52...

CVE-2016-5193

Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages...

December 9, 2016 — KB3201845 (OS Build 14393.479)

None None...

Cumulative Update for Windows 10 Version 1607 and Windows Server 2016: December 9, 2016

None None...

UBUNTU-CVE-2016-5207

In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page...

Microsoft Browser Information Disclosure Vulnerability

An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be...

The vulnerability of the Firefox browser allows a malicious attacker to compromise the confidentiality and integrity of protected information.

The vulnerability in the implementation of XrayWrapper in Mozilla Firefox allows malicious actors to bypass access restrictions by using a specially crafted web page, provided that the user visits it through a debugger. This enables operations such as unwrapping and calling DOM methods on unwrapp...

Hippo CMS: source code security analysis report

Several vulnerabilities were discovered in Hippo 'Hippo CMS' software: Using XSL Transformation to Execute Any Code Violating the Java Object Model Missing XML document schema validation Using Broken or Risky Cryptographic Algorithm Incorrect Permissions for External Entities During XML Document...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service failure.

The Google Chrome browser contains a vulnerability related to incorrect checking of the render state during the focus event in the object model of the document DOM implementation of Blink for Google Chrome. Exploiting this vulnerability allows malicious actors to cause service failures or otherwi...

The vulnerability of Google Chrome browser allows a malicious individual to execute arbitrary code or trigger a service denial.

The Google Chrome browser contains a vulnerability related to errors in memory management after the release of memory in the StyleElement::removedFromDocument function in core/dom/StyleElement.cpp of Blink for Google Chrome. Exploiting this vulnerability allows malicious actors to cause system...

Symantec Endpoint Protection Manager and Client Design Vulnerability

Symantec Endpoint Protection SEP is a suite of antivirus software from Symantec Corporation. The software provides security across physical and virtual systems.SEP Manager and Client are the management and client software. A design flaw exists in the management console of Symantec Endpoint...

Enonic XP: source code security analysis report

Several vulnerabilities were discovered in Enonic AS 'Enonic XP' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из недоверенных источников HttpOnly...

LogicalDoc Document Managment System CE: source code security analysis report

Several vulnerabilities were discovered in LogicalDOC 'LogicalDoc Document Managment System CE' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из...

Allfresco Community Edition: source code security analysis report

Several vulnerabilities were discovered in Alfresco Software 'Allfresco Community Edition' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Использование метода finalize Отсутствие верификации цифровой подписи исполняемых...

Apache Apex: source code security analysis report

Several vulnerabilities were discovered in The Apache Software Foundation 'Apache Apex' software: Using XSL Transformation to Execute Any Code Missing Verification of Executable Files' Digital Signature when Executing them from Untrusted Sources HttpOnly Cookies Incorrect User Input Filtration wh...