UBUNTU-CVE-2016-1033

Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-1012,...

Hexchat IRC Client 2.11.0 - Directory Traversal

Hexchat IRC Client 2.11.0 - Directory Traversal !/usr/bin/python Meta information Exploit Title: Hexchat IRC client - Server name log directory traversal Date: 2016-01-26 Exploit Author: PizzaHatHacker Vendor Homepage: https://hexchat.github.io/index.html Software Link:...

vector-tr.com XSS vulnerability

Vulnerable URL: http://www.vector-tr.com/ara?urunkod=%22%3E%3Cscript%3Ealert%28/XSSPOSED/%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 08:13 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

CVE-2015-1805

The 1 piperead and 2 pipewrite implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed copytouserinatomic and copyfromuserinatomic calls, which allows local users to cause a denial of service system crash or possibly gain privileges via a...

+90 Vector - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application +90 Vector published at the 'play' market has multiple vulnerabilities...

Vector - Customized SSL, Dangerous filesystem permissions, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Vector published at the 'play' market has multiple vulnerabilities...

FreeBSD : Botan BER Decoder vulnerabilities (2004616d-f66c-11e5-b94c-001999f8d30b)

The botan developers reports : Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer...

New Relic: rpm.newrelic.com - monitor creation to other accounts

It is possible to create monitors for other users by changing the user id in the body of the post request when creating a new monitor. Even though my tests were unsuccessful in a XSS on the monitor information, it may be an attack vector to other vulnerabilities since the monitor information show...

Thunderbird Firefox ESR Code Execution

The vulnerability of the nsScannerString::AppendUnicodeTo function in Thunderbird email clients, as well as in Firefox and Firefox ESR browsers, arises due to buffer overflows. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure memory exhaustion ...

FreeBSD : activemq -- Unsafe deserialization (a258604d-f2aa-11e5-b4a9-ac220bdcec59)

Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports : JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message...

Comodo AntiVirus - Heap Overflow in LZX Decompression

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=737 LzxDecoder::init initializes the vector LzxDecoder-window to a fixed size of 2^method bytes, which is then used during LzxDecoder::Extract. It's possible for LZX compressed streams to exceed this size. Writes to the window buff...

Netgear ReadyNAS Remote Code Execution

Unauthenticated Remote Command Execution in Netgear ReadyNAS Surveillance ========================================================================= Product Description =================== Netgear ReadyNAS Surveillance is a NVR Network Video Recorder available for Netgear NAS systems. Vulnerabilit...

Technology sharing: the CBC, Padding Oracle attack re-interpretation, how to break HTTPS-bug warning-the black bar safety net

Why is a re-interpretation? Now about the Padding Oracle attack presentation, the better the articles including the content, are taken from this article in foreign languages. However, the text in the discussion a key issue of how to confirm the Padding bits, and no mention, which makes many puris...

Microsoft .NET Framework XML Validation Security Feature Bypass Vulnerability

Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation USA and a development platform for building Windows, Windows Store, Windows Phone, Windows Server and Microsoft Azure Windows Store, Windows Phone, Windows Server, and Microsoft Azure...

Mageia: Security Advisory (MGASA-2016-0098)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Centreon 2.5.3 Code Execution

Unauthenticated Remote Command Execution in Centreon Web Interface ================================================================== Description =========== Centreon is a popular monitoring solution. A critical vulnerability has been found in the Centreon logging class allowing remote users to...

Zimbra 8.0.9 GA - Cross-Site Request Forgery

====================================== Multiple CSRF in Zimbra Mail interface ====================================== CVE-2015-6541 Description =========== Multiple CSRF vulnerabilities have been found in the Mail interface of Zimbra 8.0.9 GA Release, enabling to change account preferences like...

Xen Denial of Service Vulnerability (CNVD-2016-01330)

Xen is a virtualization technology developed by the University of Cambridge that can be used in the Linux kernel, allowing multiple operating systems to run simultaneously. A denial of service vulnerability exists in versions prior to Xen 4.6.x that allows HVM guest users to cause a denial of...

InstantCoder 1.0 iOS - Multiple Vulnerabilities

Exploit for iOS platform in category web applications Document Title: =============== InstantCoder v1.0 iOS - Multiple Web Vulnerabilities Product & Service Introduction: =============================== You are one of the best developers in the world and you would like to code anytime, anywhere...

Adobe Photoshop CC Denial of Service Vulnerability (CNVD-2016-01085)

Adobe Photoshop CC, or Creative Cloud, is a cloud-based era of graphics processing software developed by Adobe in the United States. A denial of service vulnerability exists in Adobe Photoshop CC 2014 prior to 15.2.4, Photoshop CC 2015 prior to 16.1.2, and Bridge CC prior to 6.2, which allows...