php: Integer overflow leads to buffer overflow in virtual_file_ex

Integer overflow in the virtualfileex function in TSRM/tsrmvirtualcwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service stack-based buffer overflow or possibly have unspecified other impact via a crafted extract operation on a Z...

PT-2016-7807

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.4.22 through 4.4.28 Description The issue allows local users to obtain root access on non-SMEP platforms via a crafted application, due to extended asm statements in the get user asm ex macro that are incompatible with...

Rotten Apples: Resurgence

In June 2016, we published a blog about a phishing campaign targeting the Apple IDs and passwords of Chinese Apple users that emerged in the first quarter of 2016 referred to as the “Zycode” phishing campaign. At FireEye Labs we have an automated system designed to proactively detect newly...

Rotten Apples: Resurgence

In June 2016, we published a blog about a phishing campaign targeting the Apple IDs and passwords of Chinese Apple users that emerged in the first quarter of 2016 referred to as the “Zycode” phishing campaign. At FireEye Labs we have an automated system designed to proactively detect newly...

PT-2016-7679

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.7.5 Description The issue allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get user ex call, due to the get user asm ex macro in...

Schneider Electric GP-Pro EX ParseAPI Heap Buffer Overflow

A heap buffer overflow vulnerability exists in Schneider Electric GP-Pro EX. This is due to input validation errors when parsing project files. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted project file...

PT-2016-3398

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.38 PHP versions 5.6.x prior to 5.6.24 PHP versions 7.x prior to 7.0.9 Description The issue is caused by an integer overflow in the virtual file ex function, which can be exploited by remote attackers through a crafte...

PT-2016-6817

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.38 Description The issue allows remote attackers to cause a denial of service or possibly have other unspecified impacts. This is due to vectors involving the smart str data type in the php url parse ex function...

PT-2016-3244 · Apache +2 · Apache Xml-Rpc Library +2

Name of the Vulnerable Software and Affected Versions: Apache XML-RPC library version 3.1.3 Description: The issue allows remote attackers to execute arbitrary code via a crafted serialized Java object in an element. This is due to the library's failure to properly verify data from external...

Hack Ex - Simulator - External URLs, Native code usage, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Hack Ex - Simulator published at the 'play' market has multiple vulnerabilities...

ex-new.ru Open Redirect vulnerability

Vulnerable URL: http://ex-new.ru/.go.php?url=http://openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 09:48 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VI...

Cisco TelePresence XML Application Programming Interface Authentication Bypass Vulnerability (cisco-sa-20160504-tpxml)

Cisco TelePresence Codec TC and Collaboration Endpoint CE Software are vulnerable to a vulnerability in the XML application programming interface API which could allow an unauthenticated, remote attacker to bypass authentication and access a targeted system through the API SPDX-FileCopyrightText:...

Pro-face GP-Pro EX Security Bypass Vulnerability

Pro-face GP-Pro EX is a set of HMI screen editing and logic programming software. The Pro-face GP-Pro EX's FTP server uses hard-coded credentials, allowing remote attackers to exploit the vulnerability to access items in the device and obtain sensitive information...

Pro-face GP-Pro EX Denial of Service Vulnerability

Pro-face GP-Pro EX is a set of HMI screen editing and logic programming software from American Pro-face. A security vulnerability exists in Pro-face GP-Pro EX. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service read across boundaries...

CVE-2016-2292

Stack-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-2291

Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read via unspecified vectors...

CVE-2015-7921

The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials...

Out-of-bounds

Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read via unspecified vectors...

Heap overflow

Heap-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-7921

The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials...