Multiple installers of Toshiba memory card related software may insecurely load Dynamic Link Libraries

Overview Multiple installers of Toshiba memory card related software contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the...

PonyOS 4.0 fluttershy LD_LIBRARY_PATH Privilege Escalation

!/usr/bin/python PonyOS 4.0 has added several improvements over previous releases including support for setuid binaries and dynamic libraries. The run-time linker does not sanitize environment variables when running setuid files allowing for local root exploitation through manipulated...

Rockstar Games: XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker)

In this report, the researcher discovered a Stored XSS vulnerability in the Add Friend functionality. It worked by filling the optional Message field with a XSS payload utilized an SVG object tag and some character escaping. When the recipient of the malicious friend request clicked or tapped the...

PonyOS 4.0 - fluttershy LD_LIBRARY_PATH Local Kernel Exploit

Exploit for linux platform in category local exploits !/usr/bin/python PonyOS 4.0 has added several improvements over previous releases including support for setuid binaries and dynamic libraries. The run-time linker does not sanitize environment variables when running setuid files allowing for...

Moderate: Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update

An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 Liberty. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Moderate: Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update

An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2015-8275

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to write to arbitrary files via crafted EDOC files...

CVE-2015-8276

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to read arbitrary files via crafted EDOC files...

Code injection

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to read arbitrary files via crafted EDOC files...

Code injection

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to write to arbitrary files via crafted EDOC files...

CVE-2015-8275

The CVE-2015-8275 entry covers LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01, where an attacker can write arbitrary files via specially crafted EDOC files. Contemporary connected records confirm an arbitrary file write vulnerability exists in LVRTC eParakstitajs 3/edoc-libraries, wi...

CVE-2015-8275

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to write to arbitrary files via crafted EDOC files...

CVE-2015-8276

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to read arbitrary files via crafted EDOC files...

CVE-2015-8276

LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 contain an information disclosure vulnerability that allows an attacker to read arbitrary files via specially crafted EDOC files. The issue is described across connected sources (CNVD-2017-16012, NVD CVE-2015-8276). The root cause is inf...

PT-2017-7374

Name of the Vulnerable Software and Affected Versions LVRTC eParakstitajs version 3.0 1.3.0 edoc-libraries version 2.5.4 01 Description The issue allows attackers to write to arbitrary files by using crafted EDOC files. Recommendations For LVRTC eParakstitajs version 3.0 1.3.0, update to a versio...

PT-2017-7375

Name of the Vulnerable Software and Affected Versions LVRTC eParakstitajs version 3.0 1.3.0 edoc-libraries version 2.5.4 01 Description The issue allows attackers to read arbitrary files via crafted EDOC files. Recommendations For LVRTC eParakstitajs version 3.0 1.3.0, update to a version that...

CVE-2015-8276: Exposure of Sensitive Information to an Unauthorized Actor

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to read arbitrary files via crafted EDOC files...

CVE-2015-8275: Improper Access Control

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to write to arbitrary files via crafted EDOC files...

There are multiple vulnerabilities in IBM SDK Java Technology Edition

IBM SECURITY ADVISORY First Issued:Wed Apr 5 23:21:06 CDT 2017 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/javajan2017advisory.asc https://aix.software.ibm.com/aix/efixes/security/javajan2017advisory.asc...

The vulnerability of the Skype instant messaging program allows a hacker to execute arbitrary code.

The vulnerability of the Skype instant messaging program is related to the limitation on the download of external libraries. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted library named api-ms-win-core-winrt-string-l1-1-0.dll, which is...