PT-2017-2038 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 25.0.0.148 and earlier Description: The issue is related to a memory corruption vulnerability in the ConvolutionFilter class. This vulnerability is caused by a buffer overflow in memory, which could allow a remote...

[ASA-201705-9] lib32-flashplugin: arbitrary code execution

Arch Linux Security Advisory ASA-201705-9 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : lib32-flashplugin Type : arbitrary code execution Remote :...

CVE-2017-5240

Editions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. A malicious or malformed Flash source file can cause a denial of service condition when parsed by this component, causing the application to crash...

CVE-2017-5240

Editions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. A malicious or malformed Flash source file can cause a denial of service condition when parsed by this component, causing the application to crash...

Core Arbitrary File Upload Vulnerability

Joomla! is an open source, cross-platform content management system CMS developed using PHP and MySQL. An arbitrary file upload vulnerability exists in Joomla! Core. A low-privileged user is allowed to upload swf files...

Adobe Flash Player: Multiple vulnerabilities

Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact A remote attacke...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the Flash Player software arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code memory corruption...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the Flash Player class in the software platform is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GLSA-201704-04 : Adobe Flash Player: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201704-04 Adobe Flash Player: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly...

D-Link DCS Cross-Site Forgery Request Vulnerability

D-Link DCS-933L and others are wireless surveillance camera devices from AUO D-Link. A security vulnerability exists in several D-Link DCS cameras. An attacker can exploit the vulnerability with the help of a specially crafted Flash file to retrieve information from Live Feeds or Camera, add new...

ColdFusion Hotfix Resolves XSS, Java Deserialization Bugs

Adobe today released an important security hotfix for several versions of its ColdFusion rapid web application development platform. The company said the update addresses an input validation vulnerability CVE-2017-3008 in the software that could be used in reflected cross-site scripting XSS...

CVE-2017-7852

D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to , thus accepting requests from any domain. If a...

Cross site request forgery (csrf)

D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to , thus accepting requests from any domain. If a...

CVE-2017-7852

D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to , thus accepting requests from any domain. If a...

CVE-2017-7852

CVE-2017-7852 affects D-Link DCS series cameras (notably DCS-933L, DCS-5030L, DCS-5020L, DCS-2530L, DCS-2630L, DCS-930L, DCS-932L, DCS-932LB1). Root cause: weak CrossDomain.XML with allow-access-from set to * enables Cross-Site Request Forgery (CSRF) via malicious Flash hosted on attacker sites. ...

CVE-2017-7852

D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to , thus accepting requests from any domain. If a...

Chrome Universal XSS using a FrameNavigationDisabler bypass (CVE-2016-1673)

VULNERABILITY DETAILS When a top-level navigation is triggered on a frame displaying the initial empty document, FrameLoader::load is invoked directly: void LocalFrame::navigateDocument& originDocument, const KURL& url, bool replaceCurrentItem, UserGestureStatus userGestureStatus ... if isMainFra...

Chrome Universal XSS using Flash message loop (CVE-2016-1631)

VULNERABILITY DETAILS From /content/renderer/pepper/ppbflashmessageloopimpl. cc: int32t PPBFlashMessageLoopImpl::InternalRun const RunFromHostProxyCallback& callback ... // It is possible that the PPBFlashMessageLoopImpl object has been // destroyed when the nested message loop exits. scopedrefpt...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the ActionScript2 component of the Flash Player software platform is related to the use of memory after it is freed when method properties are set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Adobe Flash Player Use After Free Code Execution (APSB17-10: CVE-2017-3059)

A remote code execution vulnerability exists in Adobe Flash Player. The vulnerability is due to a use-after-free error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file...