flash-plugin: Multiple code-execution flaws (APSB14-27)

Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014...

CVE-2014-9163

Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014. Recent assessments: gwillcox-...

PT-2014-2027 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions prior to 13.0.0.259 Adobe Flash Player versions 14.x Adobe Flash Player versions 15.x prior to 15.0.0.246 Adobe Flash Player versions prior to 11.2.202.425 on Linux Description: The issue is related to a stack-base...

ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download

Arbitrary file download in ManageEngine Netflow Analyzer and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 30/11/2014 / Last updated: 3/12/2014 Background on the affected produc...

[The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360

Hi, This is part 9 of the ManageOwnage series. For previous parts see 1. Today we have yet another 0 day - an arbitrary file download vulnerability that be exploited unauthenticated in NetFlow Analyzer and authenticated in IT360. I'm releasing this as a 0 day because ManageEngine have been making...

Siemens Patches WinCC Vulnerabilities Likely Being Exploited

Global industrial supplier Siemens has patched two critical vulnerabilities that it believes are likely being exploited. Organizations running products using the Siemens WinCC application are urged to apply available patches immediately; the company said it is working on updates for any remaining...

Google Chrome < 39.0.2171.71 Flash Player Remote Code Execution

The version of Google Chrome installed on the remote Windows host is prior to 39.0.2171.71. It is, therefore, affected by a remote code execution vulnerability in the included Flash Player plugin, which is due to the processing of a dereferenced memory pointer. %NASLMINLEVEL 70300 C Tenable Netwo...

Netgear WNR500 Wireless Router - 'webproc?getpage' Traversal Arbitrary File Access

Netgear Wireless Router WNR500 Parameter Traversal Arbitrary File Access Exploit Vendor: NETGEAR Product web page: http://www.netgear.com Affected version: WNR500 firmware: 1.0.7.2 Summary: The NETGEAR compact N150 classic wireless router WNR500 improves your legacy Wireless-G network. It is a...

Zenario CMS 7.0.2d Cross Site Scripting / Open Redirect

Zenario CMS 7.0.2d Reflected XSS and Open Redirect Vulnerabilities Vendor: Tribal Ltd. Product web page: http://www.zenar.io Affected version: 7.0.2d Community Edition Summary: Zenario is a web-based content management system for sites with one or many languages. It is simple to use, and can grow...

Microsoft Windows Kerberos Checksum Remote Privilege Escalation Vulnerability (3011780)

This host is missing an important security update according to Microsoft Bulletin MS14-068. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

PT-2014-2025

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Description The Kerberos Key...

CVE-2014-7146

creationtimestamp| type| source ---|---|--- 2014-11-18 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41685 2014-11-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/35283 2018-05-29 15:50:33+00:00| seen|...

CVE-2014-8598

creationtimestamp| type| source ---|---|--- 2014-11-18 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41685 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mantisbtphpexec.rb 2025-02-06 03:13:42+00:00| seen|...

Fedora Update for kernel FEDORA-2014-14068

Check the version of kernel SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868489";...

Microsoft Office IME (Japanese) Privilege Elevation Vulnerability (2992719)

This host is missing a moderate security update according to Microsoft Bulletin MS14-078. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2014-6332

creationtimestamp| type| source ---|---|--- 2014-11-13 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/35229 2014-11-18 22:27:11+00:00| seen| MISP/546bc787-9bb0-45e2-9845-45da950d210b 2014-11-20 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/35308 2014-11-21...

McAfee Web Gateway GNU Bash Code Injection (SB10085) (Shellshock)

The remote host has a version of McAfee Web Gateway MWG installed that is affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a...

Privilege escalation

Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE aka IME for Japanese is installed, allow remote attackers to bypass a sandbox protection mechanism via a crafted PDF document, aka "Microsoft IME Japanese...

PT-2014-2028 · Microsoft · Windows Server 2008 +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Server versions 2003 SP2 through 2008 SP2 and R2 SP1 Microsoft Windows Vista version SP2 Microsoft Windows 7 version SP1 Microsoft Office version 2007 SP3 Description: The issue is related to the Input Method Editor IME...

CVE-2014-4077

Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE aka IME for Japanese is installed, allow remote attackers to bypass a sandbox protection mechanism via a crafted PDF document, aka “Microsoft IME Japanese...