Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04593)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04588)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04589)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04591)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Enter: No rate limit which leads to "Users information Disclosure" including verfification documents etc.

HOST api.romit.io Endpoint /v0/cash/auth/login Issue When an attacker tries to login at app.romit.io, he is prompted to enter the PIN . There is no rate limit to verify this. Although there is a an authorization header Authorization: Credential=b67b0b10571ac00444de3cffde0b5b05,...

CVE-2015-2963

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting XSS attacks via a spoofed value, as demonstrated by image/jpeg...

Hacking Team Plans to Continue Operations

UPDATE–It has been absolutely brutal week for Hacking Team. All of the company’s documents, internal communications, emails with customers, and invoices have been published, including its dealings with oppressive regimes and customers in sanctioned countries. But even with all that, company...

OpenSSL Heartbleed 漏洞 (心脏出血)

OpenSSL“心脏出血”漏洞是一个非常严重的问题。这个漏洞使攻击者能够从内存中读取多达64 KB的数据。一些安全研究员表示：无需任何特权信息或身份验证，我们就可以从我们自己的（测试机上）偷来X.509证书的私钥、用户名与密码、聊天工具的消息、电子邮件以及重要的商业文档和通信等数据。这一切是如何发生的呢？让我们一起从代码中一探究竟吧。0x01 Bug请看ssl/dlboth.c，漏洞的补丁从这行语句开始：int dtls1processheartbeatSSL s unsigned char p = &s-s3-rrec.data0, pl; unsigned short hbtype;...

Possible Denial of Service attack in Active Support

Specially crafted XML documents can cause applications to raise a SystemStackError and potentially cause a denial of service attack. This only impacts applications using REXML or JDOM as their XML processor. Other XML processors that Rails supports are not impacted. All users running an affected...

Threat Outbreak Alert RuleID15905: Email Messages Distributing Malicious Software on June 12, 2015

Medium Alert ID: 39328 First Published: 2015 June 12 14:11 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15905 may contain the following files: Name | Siz...

WordPress Group Documents Plugin <= 1.2.1 - Stored Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability, because “Display name” and “Description” fields are not escaped. Solution Update the plugin...

WordPress Group Documents Plugin <= 1.2.1 - Remote Path Traversal

This plugin is prone to a bp-group-documents-settings.php file parameter remote path traversal file location manipulation vulnerability. Solution Upgrade the plugin...

WordPress Group Documents Plugin <= 1.2.1 - Cross Site Request Forgery

This plugin is prone to a document property manipulation cross site request forgery vulnerability. Solution Update the plugin...

WordPress Group Documents Plugin <= 1.2 - Stored Cross Site Scripting

This plugin is prone to a file uploading multiple parameter stored cross site scripting vulnerability. Solution Update the plugin...

apache-poi: XML eXternal Entity (XXE) flaw

It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform more advanced XML External Entity...

Memory Error Referencing Arbitrary Code Execution Vulnerability in Adobe Reader/Acrobat (CNVD-2015-03141)

Adobe Reader/Acrobat are popular applications for processing PDF files. A memory misreference vulnerability exists in Adobe Reader/Acrobat's handling of particular PDF files, which allows remote attackers to exploit the vulnerability to construct malicious files and trick users into parsing them,...

Unspecified Memory Leakage Vulnerability in Adobe Reader/Acrobat

Adobe Reader/Acrobat are popular applications for processing PDF files. A memory disclosure vulnerability exists in Adobe Reader/Acrobat's handling of special PDF files, which allows remote attackers to exploit the vulnerability to build malicious files that can be parsed by the user and can be...

Adobe/Apache Flex ASDoc Tool XSS

The remote web server contains one or more HTML documents created with an unpatched version of the Adobe/Apache Flex ASDoc tool that is potentially affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Adobe Reader/Acrobat Javascript API Execution Limit Bypass Vulnerability (CNVD-2015-03080)

Adobe Reader/Acrobat are popular applications for processing PDF files. A vulnerability exists in Adobe Reader/Acrobat's handling of special PDF files, which allows remote attackers to exploit the vulnerability to construct malicious files and trick users into parsing them, which can bypass...

Unspecified Memory Corruption Arbitrary Code Execution Vulnerability in Adobe Reader/Acrobat (CNVD-2015-03134)

Adobe Reader/Acrobat are popular applications for processing PDF files. A memory corruption vulnerability exists in Adobe Reader/Acrobat's handling of particular PDF files, which allows remote attackers to exploit the vulnerability to construct malicious files and trick users into parsing them,...