nebraska.edu XSS vulnerability

Vulnerable URL: https://nebraska.edu/docs/budget/open-flash-chart.swf?get-data=functionalert/Openbugbounty/ Details: Description| Value ---|--- Patched:| Yes, at 04.12.2017 Latest check for patch:| 04.12.2017 16:34 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

arbfile.org XSS vulnerability

Open Bug Bounty ID: OBB-288256 Description| Value ---|--- Affected Website:| arbfile.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bankinter.com XSS vulnerability

Vulnerable URL: https://www.bankinter.com/www/es-es/cmdinicio/cmdsmv/demobroker/flashdetection.swf?flashContentURL=javascript:alert'OPENBUGBOUNTY'=DemoBROKERalternate.html=7=0=0=false=AFQjCNEf0AdDP0GDS-XWpVnRCMGY8t1TbQ Details: Description| Value ---|--- Patched:| Yes, at 02.10.2017 Latest check...

Flash Poker 2.0 - game SQL Injection

Flash Poker 2.0 - game SQL Injection Exploit Title: Flash Multiplayer Poker PHP Script 2.0 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://www.flashpoker.it/ Software Link: https://www.codester.com/items/559/flash-poker-v2-multiplayer-poker-php-script Demo:...

SQL Injection Vulnerability in Flash cms /zj/html.asp Page

Flash Flash cms is Zibo Flash Network Technology Co., Ltd. developed a corporate website system. A SQL injection vulnerability exists in the Flash cms /zj/html.asp page. The vulnerability stems from the program's failure to effectively filter user-submitted data. An attacker can exploit the...

Flash Poker 2.0 - 'game' SQL Injection

Exploit Title: Flash Multiplayer Poker PHP Script 2.0 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://www.flashpoker.it/ Software Link: https://www.codester.com/items/559/flash-poker-v2-multiplayer-poker-php-script Demo: http://www.flashpoker.it/index/ Version: 2.0 Category:...

Reflected Cross-site Scripting Vulnerability in Flash cms \module\other\member\data.asp Page

Flash Flash cms is Zibo Flash Network Technology Co., Ltd. developed a corporate website system. A reflective cross-site scripting vulnerability exists in the Flash cms \module\other\member\data.asp page. Allows an attacker to construct XSS statements to perform pop-up box operations and obtain...

Flash cms \module\html\h001\data.asp page SQL injection vulnerability

Flash Flash cms is Zibo Flash Network Technology Co., Ltd. developed a corporate website system. A SQL injection vulnerability exists in the Flash cms \module\html\h001\data.asp page. The vulnerability stems from the program's failure to filter the data submitted by the user. An attacker can...

Updated flash-player-plugin packages fix security vulnerabilities

This update upgrades Flash Player to version 26.0.0.151. Security Fixes: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF fil...

MGASA-2017-0314 Updated flash-player-plugin packages fix security vulnerabilities

This update upgrades Flash Player to version 26.0.0.151. Security Fixes: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF fil...

GSA Bounty: Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's host

We endorse sp1d3rs's summary! The PR fixing this ticket is here: https://github.com/18F/federalist/pull/1157 Thanks to the 18F team for the great experience, fast fix, and the bounty! The report details i requested the limited disclosure due to lot of sensitive info in the attachments and report...

In a remote sandbox, free to soar: Adobe Flash Windows user credentials disclosure vulnerability-vulnerability warning-the black bar safety net

One, Foreword Recently, I published about the Flash sandbox escape vulnerabilities of an article, The final result has survived ten years of the Flash Player local security sandbox died a natural death. Before this vulnerability to show us the input data to verify the correctness of importance. T...

Linux kernel elevation of privilege vulnerability (CNVD-2017-243541)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the 'sanitycheckrawsuper' function in the fs/f2fs/super.c file in versions of Linux kernel prior to 4.11.1. A local attacker could exploit...

DEBIAN-CVE-2017-10663

The sanitycheckckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors...

UBUNTU-CVE-2017-10662

The sanitycheckrawsuper function in fs/f2fs/super.c in the Linux kernel before 4.11.1 does not validate the segment count, which allows local users to gain privileges via unspecified vectors...

CVE-2016-10389

Technical details about CVE-2016-10389 are not publicly provided in the supplied documents; no affected product/version or remediation details are specified. Monitor for updates from official sources.

Threatpost News Wrap, August 18, 2017

Mike Mimoso and Tom Spring discuss this week’s security news, including recent abuse of Google Chrome extensions for fraud, a close look at Adobe’s decision to end of life Flash Player, and a backdoor discovered in NetSarang server management software’s update mechanism. Download: Threatpost News...

Adobe Flash - Invoke Accesses Trait Out-of-Bounds Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1320 The attached fuzzed swf file causes the traits of an ActionScript object to be accessed out of bounds. This can probably lead to exploitable type confusion. 0day.today 2018-02...

Rowhammer Attacks Come to MLC NAND Flash Memory

The Rowhammer attacks developed by Google more than two years ago put the focus on hardware front and center. That research allowed attackers to flip dynamic random access memory DRAM bits in order to induce those memory cells to change their state. Google’s research enabled kernel-level privileg...

Adobe Flash - Invoke Accesses Trait Out-of-Bounds

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1320 The attached fuzzed swf file causes the traits of an ActionScript object to be accessed out of bounds. This can probably lead to exploitable type confusion. Proof of Concept:...