Adobe Flash - ATF Image Packing Overflow

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=793 There is a heap overflow in ATF impage packing. To reproduce the issue, load the attach file '129' using LoadImage.swf as follows: LoadImage.swf?img=129 Proof of Concept:...

Adobe Flash - ATF Image Packing Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=793 There is a heap overflow in ATF impage packing. To reproduce the issue, load the attach file '129' using LoadImage.swf as follows: LoadImage.swf?img=129 Proof of Concept:...

Downloading Pokémon GO Game for Android? Beware! It Could be Malicious...

"Pokémon Go" has become the hottest iPhone and Android game to hit the market in forever with enormous popularity and massive social impact. The app has taken the world by storm since its launch this week. Nintendo's new location-based augmented reality game allows players to catch Pokémon in the...

Math Tricks - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Math Tricks published at the 'play' market has multiple vulnerabilities...

DNB - Base64 encoded String, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application DNB published at the 'play' market has multiple vulnerabilities...

HiveTaxi - Customized SSL, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application HiveTaxi published at the 'play' market has multiple vulnerabilities...

Alchemy - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Alchemy published at the 'play' market has multiple vulnerabilities...

HiveTaxi DEMO - Customized SSL, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application HiveTaxi DEMO published at the 'play' market has multiple vulnerabilities...

Kube Jump - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Kube Jump published at the 'play' market has multiple vulnerabilities...

Google Chrome DoS

The Google Chrome browser contains a vulnerability related to memory reclamation use-after-free error in the function WebSharedWorkerStub::OnTerminateWorkerContext in the content/worker/websharedworkerstub.cc implementation of Web Workers. Exploiting this vulnerability allows malicious actors to...

Microsoft .NET Framework Code Execution

The Microsoft .NET Framework contains a vulnerability related to the use of incorrect address space randomization ALSR. Exploiting this vulnerability allows a malicious actor to bypass ASLR protection and load additional malware code into the process to exploit other vulnerabilities...

PT-2017-1559

Name of the Vulnerable Software and Affected Versions ImageMagick versions 6.9.4-7 Description The issue is related to a directory traversal vulnerability in the magick/module.c component of ImageMagick, which can be exploited by remote attackers to load arbitrary modules via unspecified vectors...

Microsoft Visio Graphic Editors Visio Viewer Privilege Escalation

The vulnerability of Microsoft Visio graphic editors and the Microsoft Visio Viewer software relates to errors during library loading. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created application...

UBUNTU-CVE-2016-4994

Use-after-free vulnerability in the xcfloadimage function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service program crash or possibly execute arbitrary code via a crafted XCF file...

Faraday v1.0.21 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

Microsoft Windows - Custom Font Disable Policy Bypass

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=779 Windows: Custom Font Disable Policy Bypass Platform: Windows 10 Only Class: Security Feature Bypass Summary: It’s possible to bypass the ProcessFontDisablePolicy check in win32k to load a custom font from an arbitrary file on...

CVE-2015-7776

Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196...

iMedia Digital Signage - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application iMedia Digital Signage published at the 'play' market has multiple vulnerabilities...

CVE-2016-3235

Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."...

CVE-2016-3235

Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."...