Ghosts in the Endpoint

We would like to introduce the first of our “Ghosts in the Endpoint” series, a report prepared by FireEye Labs that documents malicious software not being detected in the wild by traditional signature-based detections. In this study, all the families identified are samples from VirusTotal VT with...

CVE-2016-0122

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

CVE-2016-0127

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Serve...

MS16-039: Description of the security update for Skype for Business 2016: April 12, 2016

None None...

DEBIAN-CVE-2016-0729

Multiple buffer overflows in 1 internal/XMLReader.cpp, 2 util/XMLURL.cpp, and 3 util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service segmentation fault or memory corruption or possibly execute arbitrary code via a crafted...

海天OA /PowerSelect.asp /Documents/FolderInfor.asp /flow/BiaoDanDangAn.asp 三处char型sql注入

No description provided by source...

PDF Converter:Documents To PDF - Apache license, BSD license, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application PDF Converter:Documents To PDF published at the 'play' market has multiple vulnerabilities...

Office Documents Viewer (Free) - Dangerous filesystem permissions, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Office Documents Viewer Free published at the 'play' market has multiple vulnerabilities...

VulnCheck KEV: CVE-2013-1331

Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document...

Apple, Google Faced All Writs Act Orders

The American Civil Liberties Union has dug up more proof that from the get-go the FBI’s attempt to crack open an iPhone used by the San Bernardino shooter Syed Rizwan Farook was not just about the one phone. The ACLU found court documents and on Wednesday published an interactive map visualizing...

Google Chrome PageCaptureSaveAsMHTMLFunction::ReturnFailure Denial of Service Vulnerability

Google Chrome is a web browsing tool developed by Google. Google Chrome versions prior to 49.0.2623.108, browser/extensions/api/pagecapture/pagecaptureapi.cc/PageCaptureSaveAsMHTMLFunction:. A denial of service vulnerability exists in the ReturnFailure implementation, which can be exploited by...

Multiple Apple Products libxml2 Memory Corruption Vulnerability

Apple iOS, OS X, Safari, tvOS, and watchOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Apple OS X is a specialized operating system developed for Mac computers; Apple Safari is a web browser from Apple Inc. that is the default browser that comes with...

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows and a very small buffer is allocated. The document FAT is then memcpy'd onto t...

The vulnerability of the Microsoft .NET Framework software platform, which allows a perpetrator to forge digital signatures

The vulnerability of the Microsoft .NET Framework software arises from improper validation of digital signatures for individual elements of XML documents. Exploiting this vulnerability allows a malicious actor to forge digital signatures using modified XML documents...

Vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability of the Windows PDF library exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted PDF document...

DEBIAN-CVE-2016-1974

The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read via crafted Unicode data in an HTM...

VulnCheck KEV: CVE-2016-0021

Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

GLSA-201603-05 : LibreOffice, OpenOffice: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201603-05 LibreOffice, OpenOffice: Multiple vulnerabilities Multiple vulnerabilities were found in both LibreOffice and OpenOffice that allow the remote execution of arbitrary code and potential Denial of Service. These...

CVE-2016-0132

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."...

CVE-2016-0021

Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...