563 matches found
CVE-2017-5330
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications...
CVE-2017-5330
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications...
DEBIAN-CVE-2017-5330
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications...
CVE-2017-5330
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications...
CVE-2017-5330
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none...
CVE-2016-8753
CVE-2016-8753 entry is rejected/not used and does not represent an active vulnerability entry.
Gratipay: Avoid "resend verification email" confusion
Let's assume Alice has a Gratipay account https://gratipay.com/alice and an [email protected] email 1. Mallory creates an a1[email protected] email address, base64-encodes it, and sends Alice a link https://gratipay.com/alice/emails/verify.html?email2=YTFpY2VAZm9vLmNvbQ&nonce=x 2. When Alice opens the...
Microsoft Windows - gdi32.dll Heap Based Buffer Overflow in ExtEscape() Triggerable via EMR_EXTESCAP
Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=731 Two of the escape codes supported by the public ExtEscape API are POSTSCRIPTIDENTIFY and POSTSCRIPTINJECTION, which are only processed if the Device Context is associated with ...
CVE-2014-9298
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9750, CVE-2014-9751. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should consult CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest. All references an...
Ruby on Rails: Nested attributes reject_if proc can be circumvented by providing "_destroy" parameter
Nested attributes rejection proc bypass in Active Record. There is a vulnerability in how the nested attributes feature in Active Record handles updates in combination with destroy flags when destroying records is disabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577...
Senator Demands Answers on FBI's Use of Zero Days, Phishing
The chairman of the powerful Senate Judiciary Committee is asking some pointed questions of the FBI director about the bureau’s use of zero-day vulnerabilities, phishing attacks, spyware, and other controversial tools. Sen. Charles Grassley R-Iowa has sent a letter to FBI Director James Comey...
CVE-2013-6156
CVE-2013-6156 entry is rejected and not used.
OpenSSL 'ASN1_item_ex_d2i' Function Denial of Service Vulnerability
OpenSSL is an open source implementation of SSL used to enable strong encryption of network communications and is now widely used in a variety of web applications. A denial of service vulnerability exists in the 'ASN1itemexd2i' function of OpenSSL 'crypto/asn1/tasndec.c'. Due to the program faili...
IL and CSRF vulnerabilities in D-Link DAP-1360
Hello 3APA3A! There are Information Leakage and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model with other...
Updated ruby-rails and associated packages fix multiple vulnerabilities
Updated ruby-activerecord and ruby-actionpack packages fix security vulnerabilities: There is a data injection vulnerability in Active Record. Specially crafted strings can be used to save data in PostgreSQL array columns that may not be intended CVE-2014-0080. There is an XSS vulnerability in th...
Design/Logic Flaw
The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...
FBI Cyber Division put 'Syrian Electronic Army' Hackers in wanted list
The Syrian Electronic Army SEA, a pro-regime hacker group that emerged during Syrian anti-government protests in 2011, and involved in cyber attacks against western media organizations are now in the FBI's wanted list. The Federal Bureau of Investigation has issued an alert warning of cyber attac...
Twitter Enables Two-Factor Authentication
Responding to a wave of high-profile account takeovers in recent months, Twitter has implemented a phone-based two-factor authentication scheme that will require a numerical code along with a username and password when users log in to their accounts. The feature, known as login verification, is...
Financial Times hacked by Syrian Electronic Army
The Financial Times has become the latest news outlet to be hacked by supporters of the Syrian president Bashar al-Assad, following a phishing attack on the company's email accounts. The posh broadsheet's Tech Blog - at https://blogs.FT.com/beyond-brics was compromised to run stories headlined...