Microsoft Windows MSHTML Engine - (Edit) Remote Code Execution Exploit

Exploit for windows platform in category local exploits Exploit Title: Microsoft Windows CVE-2019-0541 MSHTML Engine "Edit" Remote Code Execution Vulnerability Google Dork: N/A Date: March, 13 2019 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link:...

PT-2019-19696 · Poppler +2 · Poppler +2

Name of the Vulnerable Software and Affected Versions: Poppler version 0.74.0 Description: An issue in the JBIG2Stream::readTextRegion function, located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file. This allows an attacker to cause a Denial of Service Segmentation fault or...

The vulnerability of the Windows GDI component of the Windows operating system, which allows a hacker to compromise sensitive information

The vulnerability of the Windows GDI component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially crafted document or web page...

Beers with Talos Ep. #46 - Privacy Pwnd: ExileRAT and Collecting Bad Karma

Beers with Talos BWT Podcast Ep. 46 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 46 show notes: Recorded Feb. 1, 2019 Today we discuss threats that bridge the gap between violating privacy and classic...

[SECURITY] Fedora 29 Update: xerces-c27-2.7.0-28.fc29

Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and wri te XML data. A shared library is provided for parsing, generating, manipulatin g, and validating XML documents. Xerces-C is faithful to the XML 1.0...

Microsoft Windows GDI Remote Code Execution Vulnerability (CNVD-2019-16510)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Graphics Device Interface GDI is one of the graphic device interfaces. A remote co...

Windows GDI Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. There are multiple ways an attacker could explo...

KLA11418 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to obtain sensitive information, gain privileges, execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerabili...

USN-3883-1 libreoffice vulnerabilities

It was discovered that LibreOffice incorrectly handled certain document files. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. CVE-2018-10119, CVE-2018-10120, CVE-2018-11790 It was discovere...

PT-2019-1767 · Poppler +4 · Poppler +4

Name of the Vulnerable Software and Affected Versions: Poppler version 0.73.0 Description: The issue is related to a heap-based buffer over-read in the XRef::getEntry function of the Poppler library, which is used for displaying PDF files. This is caused by an integer signedness error. Exploitati...

CVE-2018-17679

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

RogueRobin Malware Uses Google Drive as C2 Channel

A custom malware used by the APT known as DarkHydrus uses a mix of novel techniques, including using Google Drive as an alternate command-and-control C2 channel. According to Palo Alto’s Unit 42 intelligence division, the targeted attack involved spear-phishing emails written in Arabic sent to...

Millions of Oklahoma Gov Files Exposed by Wide-Open Server

Millions of sensitive files on a storage server belonging to the Oklahoma Department of Securities were left exposed for a week – including credentials, internal docs and personal data stretching back decades. Researchers at UpGuard who discovered the data leak said that the publicly accessible...

Arbitrary Command Execution

ghostscript is vulnerable to arbitrary command execution. An incomplete fix for CVE-2018-16509 allows an attacker to exploit another variant of the vulnerability and bypass the -dSAFER protection to execute arbitrary command via malicious PostScript documents...

Information Disclosure

libreoffice is vulnerable to information disclosure. It was discovered that LibreOffice did not properly restrict automatic link updates. By tricking a victim into opening specially crafted documents, an attacker could possibly use this flaw to disclose contents of files accessible by the victim...

Cross-Site Scripting (XSS) In Darkfish.js

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL...

Google Chrome PDFium has an unspecified vulnerability

Google Chrome is the United States Google Google company developed a Web browser. PDFium is one of the open source PDF rendering engine. A security vulnerability exists in PDFium in versions of Google Chrome prior to 71.0.3578.80. A remote attacker can exploit the vulnerability with the help of...

Description of the security update for Office 2016: January 8, 2019

None None...

Foxit Reader and PhantomPDF for Windows Validation Bypass Vulnerability

Foxit Reader for Windows is China's Foxit Foxit software company's a Windows-based platform for PDF document reader. PhantomPDF for Windows is its commercial version. A security vulnerability exists in Foxit Reader 9.3.0.10826 and earlier versions and PhantomPDF 9.3.0.10826 and earlier versions f...

Wide-Ranging German Doxxing Incident Hits Hundreds of Politicians

Hundreds of German politicians, including Chancellor Angela Merkel, have been doxxed in a puzzling incident, with their private information and political documents dumped online. At least one local reporter is claiming the information is explosive. According to a report from German public...