Microsoft Office: Rely on VML for displaying graphics in browsers

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013vmlforbrowsergraphics.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Rely on VML for displaying graphics in browsers Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Office: Allow PNG as an output format

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013pngoutputformat.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Allow PNG as an output format Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program ...

Code injection

IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856...

CVE-2017-1756

IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856...

CryptoNote Command Execution Vulnerability

CryptoNote is a cryptocurrency system. A security vulnerability exists in CryptoNote version 0.8.9, which stems from the program not requiring authentication. A remote attacker could exploit the vulnerability to execute commands and take control of a cryptocurrency wallet via a web page hosting...

[SECURITY] Fedora 26 Update: php-7.1.15-1.fc26

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Trend Micro Maximum Security Regex Matching Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Maximum Security. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the...

chrome:Persistent UXSS via SchemaRegistry(CVE-2016-1676)

Chrome version: 50.0.2661.75 and still present on current HEAD, 52.0.2713.0 The SchemaRegistry stores extension API schemas in a single v8::Context that lives until the RenderThread =process? is destroyed. Due to vulnerabilities in binding.js, these objects can be intercepted by malicious web...

CVE-2018-6217

The WStr::allociostrdata function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 allows remote attackers to cause a denial of service application crash via a crafted a web page, b office document, or c .rtf file...

[SECURITY] Fedora 26 Update: php-7.1.13-1.fc26

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

CVE-2017-1478

IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 128613...

Phishers Are Upping Their Game. So Should You.

Not long ago, phishing attacks were fairly easy for the average Internet user to spot: Full of grammatical and spelling errors, and linking to phony bank or email logins at unencrypted http:// vs. https:// Web pages. Increasingly, however, phishers are upping their game, polishing their copy and...

CVE-2017-8153

Huawei VMall for Android with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design. An attacker can trick users into installing a malicious app which can send out HTTP requests and execute JavaScript code in web pages without obtaining the Internet access...

Authentication flaw

VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of authentication for accessing web pages. An unauthenticated attacker could bypass the authentication by sending a crafted HTTP request. 5010 with...

CVE-2017-2738

CVE-2017-2738 affects Huawei’s VCM5010; versions earlier than V100R002C50SPC100 suffer two flaws: (1) authentication bypass due to improper authentication for web pages, enabling an unauthenticated attacker to bypass login via crafted HTTP requests, and (2) arbitrary file upload due to lack of fi...

Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability (CNVD-2017-36629)

Microsoft Edge is a popular browser. A remote memory corruption vulnerability exists in the Microsoft Edge scripting engine, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be parsed by the user with elevated privileges...

[SECURITY] Fedora 27 Update: php-7.1.11-1.fc27

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 25 Update: php-7.0.25-1.fc25

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Google Chrome memory misreference vulnerability (CNVD-2017-33602)

Google Chrome for Linux, Windows, Mac and Android is a web browser based on Linux, Windows, Mac and Android platforms developed by Google Google.V8 is one of the open source JavaScript engine. A memory misreference vulnerability exists in V8 in Google Chrome for Mac, Windows, Linux and Android...

cheraw.co.schoolwebpages.com XSS vulnerability

Open Bug Bounty ID: OBB-323688 Description| Value ---|--- Affected Website:| cheraw.co.schoolwebpages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...