Microsoft Publisher Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Publisher software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example,...

Description of the security update for Publisher 2010: September 12, 2017

Description of the security update for Publisher 2010: September 12, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Comm...

Description of the security update for Publisher 2007: September 12, 2017

Description of the security update for Publisher 2007: September 12, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Comm...

inClick Cloud Server 5.0 - SQL Injection

inClick Cloud Server 5.0 - SQL Injection Exploit Title: inClick Cloud Server 5.0 - SQL Injection Dork: N/A Date: 12.09.2017 Vendor Homepage: http://www.inclick.net/ Software Link: http://www.inclick.net/pageid/demo.html Demo: http://www.inclick.net/pageid/demo.html Version: 5.0 Category: Webapps...

Microsoft Office Publisher CVE-2017-8725 Remote Code Execution Vulnerability

Description Microsoft Office Publisher is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected...

Security Updates for Microsoft Publisher Products (September 2017)

The Microsoft Publisher Products are missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker who successfully exploited the...

inClick Cloud Server 5.0 - SQL Injection

Exploit Title: inClick Cloud Server 5.0 - SQL Injection Dork: N/A Date: 12.09.2017 Vendor Homepage: http://www.inclick.net/ Software Link: http://www.inclick.net/pageid/demo.html Demo: http://www.inclick.net/pageid/demo.html Version: 5.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A...

BSides Manchester: Malvertising – under the hood

I've talked about malvertising a fair bit at security events down the years and I was lucky enough to be able to add to the tally at this month's BSides Manchester conference. Whether your preferred variety is desktop, mobile, or even virtual/augmented reality, there's hopefully something here fo...

WordPress Podlove Podcast Publisher SQL Injection Vulnerability

WordPress Podlove Podcast Publisher is a workflow-oriented solution for podcasters who want to save time and gain complete control over the integrity of their Podcast publishing process, published content, and published content. A SQL injection vulnerability exists in the orderby parameter in...

CVE-2017-12949

lib\modules\contributors\contributorlisttable.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF...

Design/Logic Flaw

lib\modules\contributors\contributorlisttable.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF...

CVE-2017-12949

lib\modules\contributors\contributorlisttable.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF...

CVE-2017-12949

Podlove Podcast Publisher plugin for WordPress contains a SQL injection in lib/modules/contributors/contributor_list_table.php affecting version 2.5.3 and earlier, via the orderby parameter in wp-admin/admin.php and exploitable through CSRF. The issue is associated with CVE-2017-12949 and has bee...

To Keep Players Happy, First Seek Understanding

Me: To keep your players happy - you need to understand why they're not. You: Uh, yeah obviously. Thanks. So what? Actually, I have a lot to say on the topic of keeping players happy. A few months back I wrote a quick post about Friction. Friction, as I defined it, is anything that prompts your...

WordPress Podlove Podcast Publisher 2.5.3 SQL Injection Vulnerability

Exploit for php platform in category web applications Advisory Title: WordPress Podlove Podcast Publisher Plugin Security Vulnerability Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Podlove Podcast Publisher plugin Language: PHP Version: 2.5.3 and below Vendor Status...

CVE-2017-10157

Vulnerability in the BI Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-10157

Vulnerability in the BI Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-10156

Vulnerability in the BI Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-10156

Vulnerability in the BI Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-10030

Vulnerability in the BI Publisher component of Oracle Fusion Middleware subcomponent: Web Server. The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks...