CVE-2016-5214

CVE-2016-5214 is a Chromium/Chrome download-protection bypass due to insufficient validation. The issue was disclosed in multiple advisories and is associated with the Chromium/Chrome download handling component, enabling a remote attacker to bypass the Mark of the Web protection via crafted HTML...

CVE-2016-5196

Removed by vendor...

Apple macOS Sierra Assets Component File Download Vulnerability

Apple macOS Sierra is a specialized operating system developed by Apple for Mac computers.Assets is one of the library components that supports multiple image selection. A security vulnerability exists in the Assets component of Apple macOS Sierra versions prior to 10.12.2. An attacker could...

SaAT Netizen fails to properly verify downloaded installation and update files

Overview SaAT Netizen contains a vulnerability where files downloaded for installation or an update are not properly verified. The SaAT Netizen installer and SaAT Netizen contain a vulnerability where downloaded files are not properly verified during the installation or update process...

CVE-2016-5214

Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the Mark of the Web via a crafted HTML page...

Resources Downloaded over Insecure Protocol

Overview Affected versions of igniteui download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection. Recommendation The igniteui package h...

Missing delay following user click events in protocol handler dialog — Mozilla

Security researcher window reported an issue where the protocol handler dialog appears, double click events are treated as two single click events. This was caused by the lack of a delay following the initial focus in the file download dialog. This could cause a second dialog to be sent the secon...

redhat-upgrade-tool: does not check GPG signatures on package installation

It was found that the redhat-upgrade-tool did not check GPG signatures on downloaded and installed packages during the upgrade process...

USN-2348-1 apt vulnerabilities

It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met. CVE-2014-0487 It was discovered that APT did not invalidate repository data when it switched from an unauthenticated to an authenticated state. CVE-2014-0488 It was discovered that the APT...

UBUNTU-CVE-2014-0487

APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors...

talkback 2.3.14 Multiple Vulnerabilities

No description provided by source. JIKO No-exploit.Com Download:http://scripts.oldguy.us/talkback/downloads2/talkback2.3.14.zip Script : talkback V 2.3.14 Dork:inurl:test.php Powered by TalkBack -------------------------------------------- Edit Comment + talkback/comments.php?edit=1&editid=2&...

The KMPlayer 3.0.0.1440 .mp3 Buffer Overflow Exploit XPSP3 DEP Bypass

No description provided by source. !/usr/bin/python The KMPlayer 3.0.0.1440 .mp3 Buffer Overflow Exploit XPSP3 DEP Bypass Downloaded from: http://download.cnet.com/The-KMPlayer/3000-136324-10659939.html 06 Jun 11 Cobbled together by dookie and ronin This exploit performs DEP bypass on WinXP SP3...

Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection

Arabic Prawn Gem for Ruby contains a flaw in the lib/stringutfsupport.rb file. The issue is due to the program failing to sanitize user input. This may allow a remote attacker to inject arbitrary commands. "lib/stringutfsupport.rb" in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to...

Design/Logic Flaw

The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site...

GOM Video Converter Buffer Overflow

!/usr/bin/python ============================================================= GOM Video Converter .dll Buffer Overflow Exploit Downloaded from: http://converter.gomlab.com/eng/download/ 11/06/2012 Ucha Gobejishvili Tested Platform: Windows 7...

CVE-2012-3713

Apple Safari before 6.0.1 does not properly handle the Quarantine attribute of HTML documents, which allows user-assisted remote attackers to read arbitrary files by leveraging the presence of a downloaded document...

Google Chrome for Android - Multiple 'file::' URL Handler Local Downloaded Content Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/55523/info Google Chrome for Android is prone to multiple vulnerabilities. Attackers may exploit these issues to execute arbitrary code in the context of the browser, obtain potentially sensitive information, bypass the same-origin policy, and steal...

Small windows can be used in several ways to trick users into executing downloads

When the download dialog is displayed, it should always be visible to the user, to ensure that the user realizes it is there. If the dialog is displayed in a small enough window, the user may not realize it is being displayed, and if the right keyboard sequence is carefully followed, they can end...

Poison Ivy Variant Changes Benign Code to Malicious After Download

Trojan downloaders are the cannon fodder of the malware world: expendable, commoditized foot soldiers with a single function. Once their job is complete–downloading the executable or other malicious component–the downloaders are no longer useful. However, researchers have found that there are now...

KMPlayer 3.0.0.1440 Buffer Overflow

!/usr/bin/python The KMPlayer 3.0.0.1440 .mp3 Buffer Overflow Exploit XPSP3 DEP Bypass Downloaded from: http://download.cnet.com/The-KMPlayer/3000-136324-10659939.html 06 Jun 11 Cobbled together by dookie and ronin This exploit performs DEP bypass on WinXP SP3 with 2 different offsets. In our...