Craftable - Crafting Guide - Dynamic Code Loading, External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Craftable - Crafting Guide published at the 'play' market has multiple vulnerabilities...

Furniture Crafting Recipes - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Furniture Crafting Recipes published at the 'play' market has multiple vulnerabilities...

Crafting Guide - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Crafting Guide published at the 'play' market has multiple vulnerabilities...

Cybozuo Office 10.2.0 - 10.3.0 Open Redirect Vulnerability

Cybozu Office is prone to an open redirect vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cybozu:office";...

bind: delegation handling denial of service

A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash...

Code injection

The initt38infoconv function in epan/dissectors/packet-t38.c in the T.38 dissector in Wireshark 1.12.x before 1.12.9 does not ensure that a conversation exists, which allows remote attackers to cause a denial of service application crash via a crafted packet...

CVE-2015-8716

Wireshark 1.12.x before 1.12.9 is vulnerable to CVE-2015-8716. The init_t38_info_conv function in epan/dissectors/packet-t38.c does not ensure a conversation exists, enabling remote attackers to crash the application via a crafted T.38 packet. Remediation per the linked description is to upgrade ...

CVE-2015-8720

Wireshark CVE-2015-8720: The BER dissector’s dissect_ber_GeneralizedTime (epan/dissectors/packet-ber.c) poorly checks sscanf, enabling denial of service (crash) via crafted packets. Affected: Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1. Remediation: upgrade to 1.12.9+ or 2.0.1+ (or newe...

libpng: buffer overflow

It was discovered that the pnggetPLTE and pngsetPLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer...

CVE-2015-6399

The Supervisor 1.0.0.0 and 1.0.0.1 in Cisco Integrated Management Controller IMC before 2.09 allows remote authenticated users to cause a denial of service IP interface outage via crafted parameters in an HTTP request, aka Bug ID CSCuv38286...

ntp: ntpd accepts unauthenticated packets with symmetric key crypto

It was found that ntpd did not check whether a Message Authentication Code MAC was present in a received packet when ntpd was configured to use symmetric cryptographic keys. A man-in-the-middle attacker could use this flaw to send crafted packets that would be accepted by a client or a peer witho...

Microsoft Windows Denial of Service Vulnerability

Microsoft Windows is a series of operating systems designed for personal computer and server users from the American company Microsoft. Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold 8.1,Windows 10 Gold 1511 Error Handling Encryption Protocol, a denial of servi...

Cisco AsyncOS Denial of Service Vulnerability (CNVD-2015-07403)

The Cisco AsyncOS operating system is available to enhance the security and performance of Cisco email security appliances. Cisco AsyncOS message filters are configured with a variety of rules that incorrectly process malformed fields. a remote attacker can construct attachments to special messag...

Google Picasa 'phase one' tag integer overflow vulnerability

Google Picasa is a set of free image management tools. An integer overflow vulnerability exists in Google Picasa 'phase one' tag handling. A remote attacker can exploit this vulnerability to construct a malicious file and trick the application into parsing it, which could crash the application or...

eXtplorer Cross-Site Request Forgery Vulnerability (CNVD-2015-06704)

eXtplorer is a PHP-based online file management program. A cross-site request forgery vulnerability exists in eXtplorer. It allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context of the target user...

OpenSSH MaxAuthTries Bypass

The remote SSH server is affected by a security bypass vulnerability due to a flaw in the keyboard-interactive authentication mechanisms. The kbdintnextdevice function in auth2-chall.c improperly restricts the processing of keyboard-interactive devices within a single connection. A remote attacke...

CVE-2015-6248

The ptvcursoradd function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service application crash via a crafted packet...

CVE-2015-6247

The dissectopenflowtablemodv5 function in epan/dissectors/packet-openflowv5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12.7 does not validate a certain offset value, which allows remote attackers to cause a denial of service infinite loop via a crafted packet...

CVE-2015-6249

The dissectwccp2r1addresstableinfo function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses, which allows remote attackers to cause a denial of service application crash via a...

Drupal Form API Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. Drupal suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...