Microsoft Excel Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with...

UBUNTU-CVE-2018-5309

In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function base/PdfObjectStreamParserObject.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound. In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function base/PdfObjectStreamParserObject.cpp. Remote attackers could leverage this vulnerability to...

PT-2018-16886 · Podofo +2 · Podofo +2

Name of the Vulnerable Software and Affected Versions: PoDoFo version 0.9.5 Description: The issue is related to an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function. Remote attackers could leverage this to cause a denial-of-service via a crafted pdf file...

Microsoft Office Equation ASLR Bypass

A remote code execution vulnerability exists in Microsoft Office with embedded Equation objects. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted Office file. Successful exploitation would allow an attacker to bypass the ASLR mechanism and execute...

Information disclosure

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how the Microsoft Edge PDF Reader handles objects in memory, aka "Microsoft Edge Information Disclosure...

CVE-2018-0745

The Windows kernel in Windows 10 version 1703. Windows 10 version 1709, and Windows Server, version 1709 allows an information disclosure vulnerability due to the way objects are handled in memory, aka "Windows Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0746 and...

Dozer command execution vulnerability

Dozer is a mapper for Java beans that copies data from one object to another. A security vulnerability exists in Dozer that stems from the program's use of reflection-based methods for type conversion. The vulnerability can be exploited by a remote attacker to execute arbitrary code using special...

Microsoft Color Management Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that the Color Management Module ICM32.dll handles objects in memory. This vulnerability allows an attacker to retrieve information to bypass usermode ASLR Address Space Layout Randomization on a targeted system. By itself, the information...

Microsoft Edge PDF Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability, in a web-based attack...

Description of the security update for the ATMFD.dll information disclosure vulnerability in Windows Server 2008: January 3, 2018

Description of the security update for the ATMFD.dll information disclosure vulnerability in Windows Server 2008: January 3, 2018 Summary An information disclosure vulnerability exists in Adobe Type Manager Font Driver ATMFD.dll when it fails to properly handle objects in memory. An attacker who...

Windows Kernel Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create ne...

Arbitrary Code Execution

dozer is vulnerable to arbitrary code execution attacks. It incorrectly uses a reflection-based approach to type conversion which allows attackers to execute code through serialized objects...

Oracle WebLogic WSAT Remote Code Execution

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WSAT endpoint due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of...

Apache Groovy MethodClosure Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Groovy. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on implementation. The specific flaw exists within the handling of...

The vulnerability of the Apache Commons Collections library, related to the restoration of unreliable data in memory, allows attackers to execute arbitrary commands.

The vulnerability of the Apache Commons Collections library is related to the rehydration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using a specially crafted serialized Java object...

CHM Help Files Deliver Brazilian Banking Trojan

Security researchers are warning of a new spam campaign targeting Brazilian institutions that contain Compiled HTML file attachments that are used to deliver a banking Trojan. Spam messages contain a malicious CHM attachment called “comprovante.chm”, wrote Rodel Mendrez, senior security researche...

CVE-2017-14833

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the sty...

CVE-2017-14833

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the sty...

CVE-2017-16577

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...