Windows DVD Maker 6.1.7 XXE Injection

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt + ISR: ApparitionSec Vendor: ================= www.microsoft.com Product: ================= Windows DVD Maker...

Microsoft Windows DVD Maker 6.1.7 - XML External Entity Injection

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt + ISR: ApparitionSec Vendor: ================= www.microsoft.com Product: ================= Windows DVD Maker...

Windows DVD Maker 6.1.7 - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt + ISR: ApparitionSec Vendor: =================...

Microsoft Windows DVD Maker 6.1.7 - XML External Entity Injection

Microsoft Windows DVD Maker 6.1.7 - XML External Entity Injection + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt + ISR: ApparitionSec Vendor: =================...

Microsoft Windows DVD Maker Cross-Site Request Forgery Vulnerability (3208223)

This host is missing an important security update according to Microsoft Bulletin MS17-020. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Rage Comic Maker - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Rage Comic Maker published at the 'play' market has multiple vulnerabilities...

Windows DVD Maker XML External Entity Information Disclosure Vulnerability

An information disclosure vulnerability exists in Windows when Windows DVD Maker fails to properly parse a specially crafted .msdvd file. An attacker who successfully exploited the vulnerability could obtain information to further compromise a target system. To exploit the vulnerability, an...

March 2017 Security Only Quality Update for Windows 7 SP1 and Windows Server 2008 R2 SP1

March 2017 Security Only Quality Update for Windows 7 SP1 and Windows Server 2008 R2 SP1 Summary This security update resolves the following vulnerabilities in Windows 7 SP1 and Windows Server 2008 R2 SP1: MS17-022 Security update for Microsoft XML Core Services MS17-021 Security update for...

MS17-020: Security update for Windows DVD Maker: March 14, 2017

Resolves an information disclosure vulnerability in Windows DVD Maker. This vulnerability could allow an attacker to obtain information to further compromise a targeted system.SummaryTo learn more about the vulnerability that this update fixes, see Microsoft Security Bulletin MS17-020. More...

MS17-020: Security Update for Windows DVD Maker (3208223)

The remote Windows host is missing a security update. It is, therefore, affected by an information disclosure vulnerability in Windows DVD Maker due to improper parsing of .msdvd files. An unauthenticated, remote attacker can exploit this issue, by convincing a user to execute a specially crafted...

KLA10987 Information disclosure in Windows DVD Maker

An improper parsing of .msdvd files was found in Windows DVD maker. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed .msdvd file. Original advisories MS17-020 CVE-2017-0045 Exploitation Public...

Microsoft Windows DVD Maker CVE-2017-0045 Cross Site Request Forgery Vulnerability

Description Microsoft Windows DVD Maker is prone to an unspecified cross-site request forgery vulnerability because it fails to properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application...

Meme Maker Script 2.1 SQL Injection

Exploit Title: Meme Maker Script 2.1 - SQL Injection Google Dork: N/A Date: 01.03.2017 Vendor Homepage: http://www.memesoftware.com/ Software: http://www.memesoftware.com/mememaker.php Demo: http://www.memefaces.me/ Version: 2.1 Tested on: Win7 x64, Kali Linux x64 Exploit Author: Ihsan Sencan...

Meme Maker Script 2.1 - user SQL Injection

Meme Maker Script 2.1 - user SQL Injection Exploit Title: Meme Maker Script 2.1 - SQL Injection Google Dork: N/A Date: 01.03.2017 Vendor Homepage: http://www.memesoftware.com/ Software: http://www.memesoftware.com/mememaker.php Demo: http://www.memefaces.me/ Version: 2.1 Tested on: Win7 x64, Kali...

Meme Maker Script 2.1 - 'user' SQL Injection

Exploit Title: Meme Maker Script 2.1 - SQL Injection Google Dork: N/A Date: 01.03.2017 Vendor Homepage: http://www.memesoftware.com/ Software: http://www.memesoftware.com/mememaker.php Demo: http://www.memefaces.me/ Version: 2.1 Tested on: Win7 x64, Kali Linux x64 Exploit Author: Ihsan Sencan...

wordpress plugin application-maker-crm-edition cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin application-maker-crm-edition, which allows an attacker t...

php: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE

The exifprocessIFDinMAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service out-of-bounds array access and memory corruption, obtain sensitive information from process memory, or possibly have...

Icecream Apps Insecure File Permissions / Privilege Escalation

Exploit Title: Multiple Icecream Apps Local Privilege Escalation Date: 13/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: icecreamapps.com Software Versions Affected: Icecream Ebook Reader 4.21 | Icecream Screen Recorder 4.21...

PHP exif_process_IFD_in_MAKERNOTE Information Disclosure Vulnerability

PHP is a widely used general-purpose scripting language that is particularly well suited for web development and can be embedded in HTML. An information disclosure vulnerability exists in the ext/exif/exif.c/exifprocessIFDinMAKERNOTE function in versions prior to PHP 5.5.38, 5.6.x prior to 5.6.24...

TP-Link Loses Control Over Configuration Domain

Top router firm TP-Link has lost control of two key domains accessed by millions of consumers and small businesses each month. The domains, which are used to configure the company’s routers, have expired and been resold to domain name brokers who are actively seeking buyers. Security experts say...