Microsoft InfoPath: Disable UI Extending from Documents and Templates

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officenouiextendinginfopath.nasl 12129 2018-10-26 13:57:15Z cfischer $ Check value for Disable UI extending from documents and templates InfoPath Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Foxit Reader and Foxit PhantomPDF JavaScript Engine Memory Misreference Vulnerability (CNVD-2018-20718)

Foxit Reader is China Foxit Foxit software company a PDF document reader.Foxit PhantomPDF is a commercial version.JavaScript engine is one of the JavaScript scripting engine. A memory misreference vulnerability exists in the JavaScript engine in Foxit Reader 9.2.0.9297 and earlier versions and...

Design/Logic Flaw

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can...

CVE-2018-16294

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can...

PT-2018-16357 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 9.2.0.9297 Description: A use-after-free issue in the JavaScript engine of Foxit PDF Reader can be exploited by opening a specially crafted PDF document, potentially leading to arbitrary code execution. An attacker mu...

Design/Logic Flaw

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the...

PT-2018-16358 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 9.2.0.9297 Description: A use-after-free issue in the JavaScript engine of Foxit PDF Reader can be triggered by a specially crafted PDF document, leading to arbitrary code execution. This can occur when a user opens a...

[SECURITY] Fedora 28 Update: libbson-1.9.5-3.fc28

This is a library providing useful routines related to building, parsing, and iterating BSON documents...

Ex-NSA Developer Gets 5.5 Years in Prison for Taking Top Secret Documents Home

A former NSA employee has been sentenced to five and a half years in prison for illegally taking a copy of highly classified documents and hacking tools to his home computer between 2010 and 2015, which were later stolen by Russian hackers. Nghia Hoang Pho, 68, of Ellicott City, Maryland—who work...

Ex-NSA Developer Gets 5.5 Years in Prison for Taking Top Secret Documents Home

A former NSA employee has been sentenced to five and a half years in prison for illegally taking a copy of highly classified documents and hacking tools to his home computer between 2010 and 2015, which were later stolen by Russian hackers. Nghia Hoang Pho, 68, of Ellicott City, Maryland—who work...

Code injection

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming...

Adwind Dodges AV via DDE

This blog post is authored by Paul Rascagneres, Vitor Ventura and with the contribution of Tomislav Pericin and Robert Perica from ReversingLabs. Introduction Cisco Talos, along with fellow cybersecurity firm ReversingLabs, recently discovered a new spam campaign that is spreading the Adwind 3.0...

Emotet on the rise with heavy spam campaign

The threat landscape is changing once again, now that the ocean of cryptocurrency miners has shrunk to a small lake. Over the last couple months, we've seen cybercriminals lean back on tried and true methods of financial theft and extortion, with the rise of a familiar Banking Trojan: Emotet...

The Collateral Damage of Trump's Extreme Declassifications

Trump has the legal right to make public whatever documents he chooses. But he's going to cause untold damage in the process...

ChakraCore JavaScript RCE

The vulnerability of the JavaScript script handler ChakraCore in Microsoft Edge and Internet Explorer is related to errors in memory object handling. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted web pages, applications, or Microsoft Offi...

Lone Wolf Technologies loadingDOCS Arbitrary File Download Vulnerability

Lone Wolf Technologies loadingDOCS is a real estate document management plug-in. An arbitrary file download vulnerability exists in the 2018-08-13 version of Lone Wolf Technologies loadingDOCS, which can be exploited by a remote attacker to download arbitrary sensitive files by sending HTTPS...

APT10 Targeting Japanese Corporations Using Updated TTPs

Introduction In July 2018, FireEye devices detected and blocked what appears to be APT10 Menupass activity targeting the Japanese media sector. APT10 is a Chinese cyber espionage group that FireEye has tracked since 2009, and they have a history of targeting Japanese entities. In this campaign, t...

Google Chrome PDFium Buffer Overflow Vulnerability

Google Chrome is the United States Google Google company developed a Web browser. PDFium is one of the open source PDF rendering engine. A buffer overflow vulnerability exists in PDFium in versions prior to Google Chrome 69.0.3497.81, which stems from the program's failure to perform boundary...

Small businesses targeted by highly localized Ursnif campaign

Cyber thieves are continuously looking for new ways to get people to click on a bad link, open a malicious file, or install a poisoned update in order to steal valuable data. In the past, they cast as wide a net as possible to increase the pool of potential victims. But attacks that create a lot ...

McAfee Night Dragon Report (Update A)

Overview McAfee has published a white paper titled “Global Energy Cyberattacks: Night Dragon,”McAfee, http://www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-night-dragon.pdf, accessed February 10, 2011. which describes advanced persistent threat activity designed to obtain...