Wondermark on Security

Another comic...

comic-con-portugal.com XSS vulnerability

Open Bug Bounty ID: OBB-292619 Description| Value ---|--- Affected Website:| comic-con-portugal.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

FreeBSD : evince and atril -- command injection vulnerability in CBT handler (01a197ca-67f1-11e7-a266-28924a333806)

GNOME reports : The comic book backend in evince 3.24.0 and earlier is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened. The same vulnerability affects atril, the Evince fork. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

evince: command injection via filename in tar-compressed comics archive

It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar CBT files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince-thumbnailer, could execute arbitrary commands in the context of the evince program...

Ubuntu: Security Advisory (USN-3351-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3351-1 evince vulnerability

Felix Wilhelm discovered that Evince did not safely invoke tar when handling tar comic book cbt files. An attacker could use this to construct a malicious cbt comic book format file that, when opened in Evince, executes arbitrary code. Please note that this update disables support for cbt files i...

UBUNTU-CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

Rage Comic Maker - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Rage Comic Maker published at the 'play' market has multiple vulnerabilities...

Chhota Bheem & Jumbo Comic - External URLs, WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Chhota Bheem & Jumbo Comic published at the 'play' market has multiple vulnerabilities...

Barbie® Comic Maker - Base64 encoded String, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Barbie® Comic Maker published at the 'play' market has multiple vulnerabilities...

ai.keyboard Comic Book theme - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application ai.keyboard Comic Book theme published at the 'play' market has multiple vulnerabilities...

androbook comic viewer - Corrupted files, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application androbook comic viewer published at the 'play' market has multiple vulnerabilities...

Comic: Slave Girl - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Comic: Slave Girl published at the 'play' market has multiple vulnerabilities...

Comic Reader - Dynamic Code Loading, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Comic Reader published at the 'play' market has multiple vulnerabilities...

Comic Maker - Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Comic Maker published at the 'play' market has multiple vulnerabilities...

Rage Comic Francais Troll Face - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Rage Comic Francais Troll Face published at the 'play' market has multiple vulnerabilities...

Bible Comic - Dynamic Code Loading, External URLs, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Bible Comic published at the 'play' market has multiple vulnerabilities...

PhD Comic Viewer - External URLs, WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application PhD Comic Viewer published at the 'play' market has multiple vulnerabilities...

Comic Widget - External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Comic Widget published at the 'play' market has multiple vulnerabilities...