CVE-2017-3072

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution...

CVE-2017-3074

Adobe Flash Player 25.0.0.148 and earlier is affected by a memory corruption vulnerability in the Graphics class (CVE-2017-3074). Successful exploitation could lead to arbitrary code execution. Public advisories indicate remediation via upgrading to at least 25.0.0.171 (and related CVEs 3068–3074...

CVE-2017-3069

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BlendMode class. Successful exploitation could lead to arbitrary code execution...

Code injection

Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods Log.v, Log.d, Log.i, Log.w, and Log.e are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition...

[ASA-201705-8] flashplugin: arbitrary code execution

Arch Linux Security Advisory ASA-201705-8 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : flashplugin Type : arbitrary code execution Remote : Yes Li...

PT-2017-2034 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 25.0.0.148 and earlier Description: The issue is related to a memory corruption vulnerability in the Graphics class. This vulnerability can be exploited to achieve arbitrary code execution. The cause of the...

PT-2017-2039 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 25.0.0.148 and earlier Description: The issue is related to a memory corruption vulnerability in the BlendMode class. This vulnerability can be exploited to achieve arbitrary code execution. The problem is caused b...

PT-2017-2036 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 25.0.0.148 and earlier Description: The issue is related to a memory corruption vulnerability in the BitmapData class of Adobe Flash Player. This vulnerability is caused by a buffer overflow in memory, which could...

SQL Injection Vulnerability in Zendo 9.1.2 zentao\lib\base\dao\dao.class.php Page

Zendo is an open source project management software. Zendo project management software version 9.1.2 zentao\lib\base\dao\dao.class.php page SQL injection vulnerability. The orderBy function fails to filter the data submitted by the user, allowing an attacker to exploit the vulnerability to obtain...

Researchers Disclose Intel AMT Flaw Research

On Friday, just as Intel released additional information regarding a critical flaw found earlier this week in a subset of its business-class PCs, the researchers behind the initial vulnerability discovery, Embedi, also published their research on the flaw. Intel warned Monday of a firmware...

EulerOS 2.0 SP1 : python (EulerOS-SA-2016-1036)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the Python CGIHandler class did not properly protect against the HTTPPROXY variable name clash in a CGI context. A remote...

SQL injection vulnerability in cid parameter of Fangfa CMS FcontentAction.class.php page

Fangfa CMS is a scalable web content management software. A SQL injection vulnerability exists in the cid parameter of the Fangfa CMS V4.0 FcontentAction.class.php page, which can be exploited by an attacker to obtain sensitive information from the database...

Local File Inclusion (LFI) Vulnerability

axis2 is vulnerable to a local file inclusion LFI vulnerability. It does not prevent the adding of the root directory of the binary distribution to the class path by axis2server.sh. Also the search for XSD/WSDL files is not limited to the service class loader by SimpleHTTPServer which allows...

Debian DLA-910-1 : libreoffice security update

CVE-2017-3157 Ben Hayak discovered that objects embedded in Writer and Calc documents may result in information disclosure. Please see https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157 / for additional information. CVE-2017-7870 An out-of-bounds write caused by a heap-based...

PT-2017-17890

Name of the Vulnerable Software and Affected Versions SquirrelMail versions prior to 20170427 0200-SVN Description The issue allows post-authentication remote code execution via a mishandled sendmail.cf file in a popen call. This can be exploited to execute arbitrary shell commands on the remote...

IHG Confirms Second Credit Card Breach Impacting 1,000-Plus Hotels

In what’s becoming a familiar refrain to guests, InterContinental Hotels Group, said late last week that payment card systems at more than 1,000 of its hotels had been breached. It’s the second breach that IHG, a multinational hotel conglomerate that counts Holiday Inn and Crowne Plaza among its...

CVE-2016-1155

HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies...

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

CVE-2016-4800

CVE-2016-4800 affects Eclipse Jetty 9.3.x prior to 9.3.9 on Windows. The path normalization in PathResource can be bypassed via a URL containing certain escaped characters (backslashes), allowing an attacker to bypass protected resource restrictions and other security constraints. The description...