[SECURITY] Fedora 27 Update: WebCalendar-1.2.9-1.fc27

WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle, DB2, Interbase, MS SQL Server, or ODBC is required. WebCalendar can be setup in a...

Microsoft Office 2007 Word Information Disclosure Vulnerability

Exploit for windows platform in category local exploits MS Office Word Information Disclosure Vulnerability Vendor homepage: http://www.microsoft.com/ MS Office homepage: https://products.office.com/ MS Office Word contains an Internet Explorer IE Script execution issue through a currently well...

Microsoft Word 2007 (x86) - Information Disclosure

Title: MS Office Word Information Disclosure Vulnerability Date: September 30th, 2017. Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: https://products.office.com/ Version: 2007 32-bits x86 Tested on: Windows 8/7/Server 2008/Vista/Server 2003/XP X86 and x64...

Microsoft Excel - OLE Arbitrary Code Execution

Title: MS Office Excel all versions Arbitrary Code Execution Vulnerability Date: September 30th, 2017. Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: https://products.office.com/ Version: 2007,2010,2013,2016 32/64 bits x86 and x64 Tested on: Windows...

Attackers Use Undocumented MS Office Feature to Leak System Profile Data

An undocumented Microsoft Office feature allows attackers to gather sensitive configuration details on targeted systems simply by tricking recipients to open a specially crafted Word document—no VBA macros, embedded Flash objects or PE files needed. The undocumented feature is being used by...

ms-group.fr XSS vulnerability

Open Bug Bounty ID: OBB-286759 Description| Value ---|--- Affected Website:| ms-group.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Juniper Junos ALG Fragmented Traffic Handling MS-MPC / MS-MIC Service PIC DoS (JSA10794)

According to its self-reported version and model number, the remote Juniper Junos device is affected by a denial of service vulnerability in the Application Layer Gateway ALG that is triggered when handling a large amount of fragmented packets. An unauthenticated, remote attacker can exploit this...

CVE-2017-11323

Stack-based buffer overflow in ESTsoft ALZip 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted MS-DOS device file, as demonstrated by use of "AUX" as the initial substring of a filename...

CVE-2017-11323

CVE-2017-11323 affects ESTsoft ALZip 8.51 and earlier. The root cause is a stack-based buffer overflow in the handling of MS-DOS device files, exploitable remotely when a crafted filename begins with substrings like AUX. Reported impact is arbitrary code execution with the attacker likely remote,...

Debian DLA-1037-1 : catdoc security update

A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service application crash or have unspecified other impact, if a specially crafted file is processed. For Debian 7 'Wheezy', these problems have been fixed in version...

[SECURITY] [DSA 3917-1] catdoc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3917-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 23, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3917-1 (catdoc - security update)

A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service application crash or have unspecified other impact, if a specially crafted file is processed. OpenVAS Vulnerability Test $Id: deb3917.nasl 6812 2017-07-31 06:15:4...

Debian: Security Advisory (DSA-3917-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Skype for business is also vulnerable to the autodiscovery issue

An issue in WPAD proxy automatic configuration was first discovered by Maxim Andreev back in 2015 at the MailRu group security meet-up and then was presented by Maxim Goncharov at BlackHat US 2016 slides. This year Ilya Nesterov and Maxim Goncharov presented a continuation of this research and...

Juniper Networks Junos OS MS-MPC or MS-MIC DoS Vulnerability

Junos OS is prone to a denial of service vulnerability when parsing large fragmented traffic through an ALG. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2015-9098

CVE-2015-9098 affects Redgate SQL Monitor versions prior to 3.10 and 4.x prior to 4.2. A remote unauthenticated attacker can gain access to the Base Monitor and execute arbitrary SQL commands on any monitored Microsoft SQL Server machines; if the Base Monitor connects using an account with SQL ad...

Debian Security Advisory DSA 3869-1 (tnef - security update)

It was discovered that tnef, a tool used to unpack MIME attachments of type OpenVAS Vulnerability Test $Id: deb3869.nasl 6607 2017-07-07 12:04:25Z cfischer $ Auto-generated from advisory DSA 3869-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2017 Greenbo...

Mantis Bug Tracker 1.3.10 / 2.3.0 Cross Site Request Forgery

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org Product: ========= Mantis Bug Tracker 1.3.10 / v2.3.0 MantisBT...

Mantis Bug Tracker 1.3.10/2.3.0 - Cross-Site Request Forgery

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org Product: ========= Mantis Bug Tracker 1.3.10 / v2.3.0 MantisBT...

[SECURITY] Fedora 25 Update: tnef-1.4.14-2.fc25

This application provides a way to unpack Microsoft MS-TNEF MIME attachment s. It operates like tar in order to unpack files of type "application/ms-tnef", which may have been placed into the MS-TNEF attachment instead of being attached separately. Such files may have attachment names similar to...