259 matches found
Heap overflow
A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record types. A specially crafted document can cause a buffer overflow, leading to memory corruption, which can result in arbitrary code execution.To trigger this...
Design/Logic Flaw
A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents. A specially crafted document can trigger reuse of freed memory, which can lead to further memory corruption and potentially result in arbitrary code execution. An...
CVE-2022-43664
A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents. A specially crafted document can trigger reuse of freed memory, which can lead to further memory corruption and potentially result in arbitrary code execution. An...
CVE-2022-43664
A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents. A specially crafted document can trigger reuse of freed memory, which can lead to further memory corruption and potentially result in arbitrary code execution. An...
CVE-2023-22660
A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record types. A specially crafted document can cause a buffer overflow, leading to memory corruption, which can result in arbitrary code execution.To trigger this...
CVE-2023-22660
A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record types. A specially crafted document can cause a buffer overflow, leading to memory corruption, which can result in arbitrary code execution.To trigger this...
CVE-2022-37369
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...
go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents
A flaw was found in go-yaml. This issue causes the consumption of excessive amounts of CPU or memory when attempting to parse a large or maliciously crafted YAML document...
Design/Logic Flaw
Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored persistent, or "Type II" XSS condition...
CVE-2022-47413
Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored persistent, or "Type II" XSS condition...
CVE-2022-47412
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition...
Cross site scripting
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition...
CVE-2022-47412 ONLYOFFICE Workspace Search Stored XSS
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS when supplied with a maliciously crafted PDF file to be parsed. PoC js var pdfReader = muhammara.createReader dirname + "/TestMaterials/BrokenPdfBadHeader.txt" ; js var pdfReader = hummus.createReader dirname +...
The vulnerability of the Corel PDF Fusion software for converting PDF files, related to buffer overflow attacks, allows attackers to execute arbitrary code within the context of the current user.
The vulnerability of the Corel PDF Fusion software for converting PDF files is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, using the malicious PDF file as a means to do so...
Kimsuky’s GoldDragon cluster and its C2 operations
Kimsuky also known as Thallium, Black Banshee and Velvet Chollima is a prolific and active threat actor primarily targeting Korea-related entities. Like other sophisticated adversaries, this group also updates its tools very quickly. In early 2022, we observed this group was attacking the media a...
PT-2022-23951 · Pdf Xchange · Pdf-Xchange Editor
Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious page or open...
China’s Tonto Team increases espionage activities against Russia
According to analyses of several cybersecurity firms and CERT Computer Emergency Response Team Ukraine CERT-UA, the state-sponsored threat actor group Tonto Team, which has been linked to China-backed cyber operations, is ramping up its spying campaign against Russian government agencies. The...
Follina: A zero-day vulnerability in Microsoft Office
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary Microsoft has issued a patch after almost 15 days for a zero-day vulnerability identified as CVE-2022-30190 after various proof-of-concept POCs indicating that it is actively exploited became public. Security...
