23894 matches found
F2fs-tools fsck.f2fs sanity_check_area_boundary code execution vulnerability
Summary An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations, resulting in code execution. An attacker can provide a malicious file to trigger this...
WHO COVID-19 Mobile App: Probably unexploitable XSS via Header Injection
Summary: The Who-Platform header is reflected in the output of the page if it's not one of the recognized Who-Platform values IOS, ANDROID, WEB. While this is probably no longer exploitable as of 2015, it may be exploitable on less well implemented browsers not Chrome/Firefox/Edge. In general,...
Holy water: ongoing targeted water-holing attack in Asia
On December 4, 2019, we discovered watering hole websites that were compromised to selectively trigger a drive-by download attack with fake Adobe Flash update warnings. This campaign has been active since at least May 2019, and targets an Asian religious and ethnic group. The threat actor's...
CVE-2019-19912
In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting XSS vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file...
CVE-2019-19912
In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting XSS vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file...
Cross site scripting
In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting XSS vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file...
CVE-2019-19912
In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting XSS vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file...
CVE-2019-19912
Intland codeBeamer ALM
PT-2020-10292 · Intland · Codebeamer Alm
Name of the Vulnerable Software and Affected Versions: Intland codeBeamer ALM versions 9.5 and earlier Description: A cross-site scripting XSS vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF...
GLSA-202003-61 : Adobe Flash Player: Remote execution of arbitrary code
The remote host is affected by the vulnerability described in GLSA-202003-61 Adobe Flash Player: Remote execution of arbitrary code A critical type confusion vulnerability was discovered in Adobe Flash Player. Impact : A remote attacker could possibly execute arbitrary code with the privileges of...
Adobe Flash Player: Remote execution of arbitrary code
Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description A critical type confusion vulnerability was discovered in Adobe Flash Player. Impact A remote attacker could possibly execute arbitrary code with the...
Hardware Router CTF
Here at Pen Test Partners we love hardware and also love a good CTF. So here's how I figured out my way through the hardware CTF that PTP set as a pre-requisite for some interviews. I'm pretty new to hardware, so learned quite a bit along the way. We have now moved on to a new 'interview' CTF so,...
The Sleuth Kit (TSK) Stack Buffer Overflow Vulnerability
The Sleuth Kit TSK is a set of command line tools and a C library that lets you analyze disk images and recover files from them. A stack buffer overflow vulnerability exists in the YAFFS file timestamp parsing logic of yaffsfsistat in fs/yaffs.c in The Sleuth Kit TSK 4.8.0 and earlier. No detaile...
reblog
Defeating a Laptop's BIOS Password We found a laptop laying a...
Stripo Inc: XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique
XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique...
RHEL 6 : flash-plugin (RHSA-2020:0513)
The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0513 advisory. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version...
Critical: Red Hat Security Advisory: flash-plugin security update
An update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
flash-plugin: Arbitrary Code Execution vulnerability (APSB20-06)
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution...