Microsoft Windows AVI File Data Validation Integer Overflow (MS09-038) - Ver2 (CVE-2009-1546)

Audio Video Interleave AVI is a special case of Resource Interchange File Format RIFF.This file type used with applications that capture, edit, and play back audio-video sequences. The vulnerability is due to an error in the Windows component responsible for processing AVI files that does not...

Enter: HTML injection in email sent by romit.io

Issue It is possible for the attacker to inject arbitary HTML code in the email sent by romit.io as " OR "img src="sth bad" OR !-- 2. Save your settings. 3. Share your wallet with any user by providing phone number. Thanks crab...

MS15-033: Description of the Microsoft Office for Mac 2011 14.4.9 update: April 14, 2015

Describes a security update that addresses vulnerabilities by correcting how Excel and other affected software validate data when they parse specially crafted Office files.IntroductionMicrosoft has released security bulletin MS15-033. This security bulletin contains all the relevant information...

Unspecified Vulnerability in Cisco IOS Autonomic Networking Infrastructure Feature

Cisco IOS is an operating system developed by Cisco for its network devices. A security vulnerability exists in the Autonomic Networking Infrastructure ANI feature of Cisco IOS, which stems from the program's failure to adequately validate data. A remote attacker could exploit the vulnerability b...

CVE-2014-7252

Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LTE F-05D, Disney Mobile on docomo F-08D, REGZA Phone T-01D, and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local user...

CVE-2014-7252

Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LTE F-05D, Disney Mobile on docomo F-08D, REGZA Phone T-01D, and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local user...

CVE-2014-7252

The CVE-2014-7252 entry relates to multiple improper data validation vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processors. The Syslink driver, used in devices such as NTT DOCOMO ARROWS and SoftBank SHARP handsets, allows local users to execute arbitrary code or read ...

JVN#67792023: Multiple improper data validation vulnerabilities in Syslink driver for Texas Instruments OMAP mobile processors

The OMAP mobile processor provided by Texas Instruments is used in some Android tablets, smartphones and other devices. The Syslink driver for some OMAP mobile processors is used to implement the communication of processes between the host and slave processors. The Syslink driver contains multipl...

Pandora FMS 5.1SP1 Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Reflected in Page visualization agents in Pandora FMS v5.1SP1 - Revisión PC141031 II. BACKGROUND Pandora FMS is the monitoring software chosen by several companies all around the world for managing their IT infrastructure. Besides ensuring high...

DSA-3025-1 apt - security update

Bulletin has no description...

Adobe Flash Player JSONP Cross-Site Request Forgery (APSB14-17: CVE-2014-4671)

A cross-site request forgery CSRF vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an insufficient validation of data from JSONP callback APIs. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

DEBIAN-CVE-2014-3480

The cdfcountchain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service application crash via a crafted CDF file...

friendsinwar FAQ Manager (view_faq.php, question param) SQL Injection Vulnerability

No description provided by source. Exploit Title: friendsinwar FAQ Manager SQL Injection URL Vulnerability Date: 16.11 2012 Exploit Author: unsuprise Vendor Homepage: http://www.friendsinwar.com Software Link:http://www.friendsinwar.com/scriptdemo/thefaqmanager/ Tested on: Windows 7, Xampp Blog :...

P-News 1.16 Administrative Account Creation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7689/info A vulnerability has been reported that could enable a P-News member to create and access an administrative account. This is due to insufficient validation of data supplied to account editing input fields of...

74CMS 二次注入两枚。

简要描述： 骑士PHP人才系统：74cms V3.4.20140530 Check Out。 详细说明： 在user/userapplyjobs.php中 if $act=="appsave" $jobsid=isset$POST'jobsid'?$POST'jobsid':exit"出错了"; $resumeid=isset$POST'resumeid'?intval$POST'resumeid':exit"出错了"; $notes=isset$POST'notes'?trim$POST'notes':""; $pmsnotice=intval$POST'pmsnotice';...

ASUS RT-AC68U Cross Site Scripting

=====Alligator Security Team - Security Advisory============================ Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface Author: Joaquim Brasil de Oliveira =====Table of Contents====================================================== 1. Overview 2. Detailed...

MGASA-2013-0378 Updated munin packages fixes two security vulnerabilities

Updated munin packages fix security vulnerabilities: The Munin::Master::Node module of munin does not properly validate certain data a node sends. A malicious node might exploit this to drive the munin-html process into an infinite loop with memory exhaustion on the munin master CVE-2013-6048. A...

NagiosQL 3.2.0 SP2 Cross Site Scripting

I. VULNERABILITY ------------------------- Reflected XSS Attacks XSS vulnerabilities in NagiosQL 3.2.0 Servicepack 2 II. BACKGROUND ------------------------- NagiosQL is a web based administration tool designed for Nagios, but might also work with forks. It helps you to easily build a complex...

OpenJDK: DefaultFormatter insufficient data validation (Swing, 7195194)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related ...

OpenJDK: DefaultFormatter insufficient data validation (Swing, 7195194)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related ...