[SECURITY] Fedora 25 Update: ming-0.4.8-1.fc25

Ming is a library for generating Macromedia Flash files .swf, written in C, and includes useful utilities for working with .swf files...

Multiple Cross-Site Scripting Vulnerabilities in b2evolution

b2evolution is a PHP and MySQL based blogging software developed by software developer FrancoisPlanque. A cross-site scripting vulnerability exists in the file type table of b2evolution versions prior to 6.8.3. The vulnerability can be exploited by remote attackers to inject arbitrary web script ...

Adobe Flash Player Type Obfuscation Vulnerability (CNVD-2016-09442)

Adobe Flash Player is a cross-platform, browser-based multimedia player product. A type confusion vulnerability exists in Adobe Flash Player, which can be exploited by remote attackers to construct malicious SWF files that can be parsed by users to execute arbitrary code...

Adobe Flash Player Memory Corruption Vulnerability (CNVD-2016-09449)

Adobe Flash Player is a cross-platform, browser-based multimedia player product. A memory corruption vulnerability exists in Adobe Flash Player, which can be exploited by remote attackers to construct malicious SWF files that can be parsed by the user to crash the application or execute arbitrary...

Adobe Flash Player Memory Corruption Vulnerability (CNVD-2016-09450)

Adobe Flash Player is a cross-platform, browser-based multimedia player product. A memory corruption vulnerability exists in Adobe Flash Player, which can be exploited by remote attackers to construct malicious SWF files that can be parsed by the user to crash the application or execute arbitrary...

Adobe Flash Player Memory Corruption Vulnerability (CNVD-2016-09453)

Adobe Flash Player is a cross-platform, browser-based multimedia player product. A memory corruption vulnerability exists in Adobe Flash Player, which can be exploited by remote attackers to construct malicious SWF files that can be parsed by the user to crash the application or execute arbitrary...

Adobe Flash Player Memory Corruption Vulnerability (CNVD-2016-09451)

Adobe Flash Player is a cross-platform, browser-based multimedia player product. A memory corruption vulnerability exists in Adobe Flash Player, which can be exploited by remote attackers to construct malicious SWF files that can be parsed by the user to crash the application or execute arbitrary...

Adobe Flash Player Memory Misreference Vulnerability (CNVD-2015-08252)

Adobe Flash Player is a widely used, proprietary multimedia program player. It was originally written by Macromedia and continued to be developed and distributed by Adobe after Macromedia was acquired by Adobe. A memory misreference vulnerability exists in Adobe Flash Player's handling of special...

VK.com: XSS at http://vk.com on IE using flash files

Steps + Open the below url in Internet Explorer http://vk.com/swf/photouploaderlite.swf?h=h?&onMouseOver=document.writewindow.location.hash.substr1alertdocument.domain + Just hover your mouse over the page. Minor Observations + No "X-Content-Type-Options: nosniff" header allows IE to play the fla...

Adobe Flash Player Unspecified Null Pointer Reference Vulnerability

Adobe Flash Player is a Flash file handling program. Adobe Flash Player suffers from an unspecified null pointer reference vulnerability that allows attackers to construct malicious SWF files that can be tricked into parsing by a user, which can execute arbitrary code in the application context...

Adobe Flash Player suffers from unspecified null pointer reference vulnerability (CNVD-2015-00941)

Adobe Flash Player is a Flash file handling program. Adobe Flash Player suffers from an unspecified null pointer reference vulnerability that allows attackers to construct malicious SWF files that can be tricked into parsing by a user, which can execute arbitrary code in the application context...

Vimeo: XSS on any site that includes the moogaloop flash player | deprecated embed code

The moogaloop flash player includes in most cases http://f.vimeocdn.com/p/flash/moogaloop/6.0.30/controllers/videoControllerProgressive.swf. In that flash file we can find functionality that looks into the SharedObject "com.conviva.livePass" for recently loaded swf-URLs under the key "lastSwfUrls...

TechSmith Camtasia 7 / 8 Cross Site Scripting

Title: Reflected XSS in Flash files of TechSmith Camtasia 8 & 7 Author: Soroush Dalili @irsdl Affected Software: TechSmith Camtasia v8.4.4 latest 8.x & v7.1.1 latest 7.x Vendor URL: http://www.techsmith.com/camtasia-version-history.html Vendor Status: vulnerable CVE-ID: - Camtasia 8 v8.4.4 latest...

XSS vulnerability in In-Portal CMS

Hello 3APA3A! After I informed developers in August about multiple vulnerabilities in In-Portal CMS and they answered they would fix them soon so wait for disclosure of the first vulnerabilities, I found new hole in this CMS at their official site. This is Cross-Site Scripting vulnerability in...

Adobe Multiple Products Flash Content Parsing Code Execution (APSA10-03: CVE-2010-2884) (CVE-2010-2884)

A remote code execution vulnerability has been reported in multiple Adobe products. The vulnerability is due to an error in the way Flash files are parsed...

WordPress WP REST API Plugin <= 1.1 - JSONP SOP Bypass

Because of this vulnerability, it is possible to serve up arbitrary Flash SWF files from the API. These Flash files bypass browser cross-origin domain policies. Solution Upgrade the plugin...

WebSiteSniffer v1.41 - Captures all Web site files downloaded by your Web browser while browsing the Internet

WebSiteSniffer is a packet sniffer tool that captures all Web site files downloaded by your Web browser while browsing the Internet, and stores them on your hard drive under the base folder that you choose. WebSiteSniffer allows you to choose which type of Web site files will be captured: HTML...

CS and XSS vulnerabilities in DZS Video Gallery for WordPress

Hello 3APA3A! There are Content Spoofing and Cross-Site Scripting vulnerabilities in plugin DZS Video Gallery for WordPress. After I announced multiple vulnerabilities in DZS Video Gallery at 08.05.2014 and informed developers, they ignored it, so the second advisory is going directly to full...

Cross-Site Scripting in news

It has been discovered that the extension "News system" news is susceptible to Cross-Site Scripting Release Date: June 3, 2014 Bulletin update: September 4, 2014 affected version clarification Component Type: Third party extension. This extension is not a part of the TYPO3 default installation...

WordPress DZS Video Gallery Cross Site Scripting / Content Spoofing

Hello list! There are Content Spoofing and Cross-Site Scripting vulnerabilities in plugin DZS Video Gallery for WordPress. After I announced multiple vulnerabilities in DZS Video Gallery at 08.05.2014 and informed developers, they ignored it, so the second advisory is going directly to full...