CVE-2015-1296

CVE-2015-1296 is a Chrome/Chromium vulnerability where the UnescapeURLWithAdjustmentsImpl in net/base/escape.cc could allow spoofing the SSL lock icon by displaying Unicode LOCK characters in the omnibox. Affected: Google Chrome prior to 45.0.2454.85. Root cause: improper handling in omnibox URL ...

CVE-2015-5190

The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL...

PT-2015-6794 · Pcs +2 · Pcs +2

Name of the Vulnerable Software and Affected Versions: PCs versions 0.9.139 and earlier Description: The issue allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL. This is related to the pcsd web UI. Recommendations: For versions 0.9.139 and earlier,...

Viber 4.2.0 Denial Of Service

!/usr/bin/perl -w -- coding: utf-8 - + Title: Viber Non-Printable Characters Handling Denial of Service Vulnerability + Product: Viber + Vendor: http://www.viber.com/en/ + SoftWare Link : https://itunes.apple.com/app/viber-free-phone-calls/id382617920?mt=8 + Vulnerable Versions: Viber 4.2.0 on IO...

Viber 4.2.0 - Non-Printable Characters Handling Denial of Service Vulnerability

Exploit for iOS platform in category dos / poc !/usr/bin/perl -w -- coding: utf-8 - + Title: Viber Non-Printable Characters Handling Denial of Service Vulnerability + Product: Viber + Vendor: http://www.viber.com/en/ + SoftWare Link :...

Viber 4.2.0 - Non-Printable Characters Handling Denial of Service

Viber 4.2.0 - Non-Printable Characters Handling Denial of Service !/usr/bin/perl -w -- coding: utf-8 - + Title: Viber Non-Printable Characters Handling Denial of Service Vulnerability + Product: Viber + Vendor: http://www.viber.com/en/ + SoftWare Link :...

The vulnerability of the Mac OS X operating system, which allows a hacker to trigger a service failure

The vulnerability of the Data Detectors Engine component in the Mac OS X operating system arises due to buffer overflow. Exploiting this vulnerability can allow a malicious actor to cause a service failure by using a sequence of Unicode characters...

Xxe

The ZendXmlSecurity::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity XXE and XML entity expansion XEE...

CVE-2015-5750

Data Detectors Engine in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted series of Unicode characters...

Memory corruption

Data Detectors Engine in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted series of Unicode characters...

CVE-2015-5750

Data Detectors Engine in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted series of Unicode characters...

CVE-2015-5750

CVE-2015-5750 affects Apple OS X Data Detectors Engine prior to 10.10.5. A crafted sequence of Unicode characters could cause memory corruption, enabling arbitrary code execution or a denial of service. Affected component is Data Detectors Engine; root cause is memory corruption from Unicode proc...

CVE-2015-2059

The stringpreputf8toucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read...

Memory corruption

The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service crash via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation...

Brasero - Crash (PoC)

Brasero - Crash PoC !/usr/bin/perl -w Title : Kali brasero - Crash Proof Of Concept website : https://www.kali.org/downloads/ Tested : kali 1.x Author : Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website : www.reza.es...

XSS vulnerability in OFBiz forms

https://issues.apache.org/jira/browse/OFBIZ-6506 In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks. display-entity entity-name="Table" description="$description" I tried to use bsh, as following: display-entity entity-name="Table"...

Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser

Hello, it is July 23, 2015, 17:00 UTC, the Coordinated Release Date for CVE-2015-3245 and CVE-2015-3246. Please find our advisory below, and our exploit attached. Qualys Security Advisory CVE-2015-3245 userhelper chfn newline filtering CVE-2015-3246 libuser passwd file handling -- Summary...

libuser / userhelper security vulnerabilities

Unsafe files handling, insufficient characters filtering...

libuser: does not filter newline characters in the GECOS field

It was found that libuser, as used by the chfn userhelper functionality, did not properly filter out newline characters in GECOS fields. A local, authenticated user could use this flaw to corrupt the /etc/passwd file, resulting in a denial-of-service on the system...

CVE-2015-5523

The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service crash via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation...