Directory traversal

In Real Player 20.0.7.309 and 20.0.8.310, external::Import allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder DLL planting could also occur...

Design/Logic Flaw

In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages displayed by Internet Explorer core. This leads to arbitrary code execution...

CVE-2022-32270

In Real Player 20.0.7.309 and 20.0.8.310, external::Import allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder DLL planting could also occur...

CVE-2022-32270

CVE-2022-32270 affects RealNetworks RealPlayer versions 20.0.7.309 and 20.0.8.310. The flaw arises in external::Import(), which permits downloading arbitrary file types and directory traversal, enabling remote code execution. Root cause is facilitate­ment of DLL planting or executables in the sta...

CVE-2022-32271

In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary loca...

CVE-2022-32271

CVE-2022-32271 relates to RealNetworks Real Player 20.0.8.310, where a DCP:// URI (an internal protocol used to reference a file containing a URL) can be abused to inject script code to arbitrary domains and reference arbitrary local files, enabling remote arbitrary code execution. The CVSS estim...

CVE-2022-32269

In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages displayed by Internet Explorer core. This leads to arbitrary code execution...

CVE-2022-32269

Real Player 20.0.8.310’s G2 Control allows injection of unsafe javascript: URIs into local HTTP error pages (displayed by the IE core), enabling arbitrary code execution. This is consistently described across CVE sources (NVD, RH Red Hat, CNNVD, PRION, etc.). A practical remediation noted in PT-2...

RealNetworks Real Player 跨站脚本漏洞

RealNetworks Real Player is a cross-platform player from RealNetworks, Inc. for enjoying a wide variety of online audio and video material. A security vulnerability exists in RealNetworks Real Player version 20.0.8.310, which can be exploited by remote attackers to conduct arbitrary code executio...

RealNetworks Real Player 跨站脚本漏洞

RealNetworks Real Player is a cross-platform player from RealNetworks, Inc. for enjoying a variety of online audio and video material. A cross-site scripting vulnerability exists in RealNetworks Real Player version 20.0.8.310, which stems from G2 Control allowing the injection of an insecure...

RealNetworks Real Player 路径遍历漏洞

RealNetworks Real Player is a cross-platform player from RealNetworks, Inc. for enjoying a wide variety of online audio and video material. A security vulnerability exists in Real Player versions 20.0.7.309 and 20.0.8.310, which stems from external::Import allows downloading of arbitrary file typ...

PT-2022-21194 · Microsoft +1 · Internet Explorer +1

Name of the Vulnerable Software and Affected Versions: Real Player version 20.0.8.310 Description: The G2 Control in Real Player allows injection of unsafe javascript: URIs in local HTTP error pages, which are displayed by the Internet Explorer core. This leads to arbitrary code execution...

Adobe Flash Player ASLR Bypass Vulnerability

Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization ASLR protection mechanism...

Adobe Flash Player and AIR Use-After-Free Vulnerability

Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code...

Adobe Flash Player Integer Overflow Vulnerability

Integer overflow in Adobe Flash Player allows attackers to execute code...

Adobe Flash Player Dereferenced Pointer Vulnerability

Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution...

Adobe Flash Player and AIR Integer Overflow Vulnerability

Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code...

PyAMF vulnerable to XML external entity (XXE)

PyAMF provides Action Message Format AMF support for Python that is compatible with the Adobe Flash Player. It includes integration with Python web frameworks like Django, Pylons, Twisted, SQLAlchemy, web2py and more. XML external entity XXE vulnerability in PyAMF before 0.8.0 allows remote...

Adobe Flash Player Stack-based Buffer Overflow Vulnerability

Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution...

GHSA-QWFV-5JWJ-582H Opencast RCE Vulnerability

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0...