CVE-2016-10190

Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response...

CVE-2016-10190

Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the JPEG XR component in the Adobe Flash Player software arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code memory corruption remotely...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, allow attackers to execute arbitrary code.

The vulnerability in the XSLT programs for PDF viewing applications such as Adobe Reader and Document Cloud, as well as in PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, is related to improper type conversion. Exploiting this vulnerability allows an attacker to execute...

Code injection

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-8418

A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of remote code execution in the context of the kernel. Product: Android. Versions:...

MetalGenix GeniXCMS SQL Injection Vulnerability (CNVD-2017-01320)

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A SQL injection vulnerability exists in the inc/lib/Options.class.php file in MetalGenix GeniXCMS 0.0.8 an...

Apache OpenOffice Text Document Malicious Macro Execution

This module generates an Apache OpenOffice Text Document with a malicious macro in it. To exploit successfully, the targeted user must adjust the security level in Macro Security to either Medium or Low. If set to Medium, a prompt is presented to the user to enable or disable the macro. If set to...

Debian: Security Advisory (DSA-3783-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Multiple Cross-Site Scripting Vulnerabilities in ZoneMinder

ZoneMinder is a security monitoring software for cameras. ZoneMinder suffers from multiple cross-site scripting vulnerabilities that allow an attacker to remotely execute malicious scripts in the browser of an authenticated client...

CVE-2017-5367

CVE-2017-5367 corresponds to multiple reflected XSS vulnerabilities in ZoneMinder (versions 1.30 and 1.29) where parameters in /zm/index.php can be manipulated to execute scripts in an authenticated user’s browser. Affected components include various query parameters (e.g., action, view, filter, ...

Microsoft Waits for Patch Tuesday to Fix SMB Zero Day

Microsoft will not rush out an emergency patch for a zero-day vulnerability disclosed on Wednesday in the Windows implementation of the Server Message Block protocol. Researcher Laurent Gaffie announced in a tweet, below, that he’d found a zero-day vulnerability in SMBv3 and released a...

[ASA-201702-5] gst-plugins-bad: multiple issues

Arch Linux Security Advisory ASA-201702-5 ========================================= Severity: Critical Date : 2017-02-03 CVE-ID : CVE-2017-5843 CVE-2017-5848 Package : gst-plugins-bad Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-165 Summary ======= The package...

Code injection

IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause processes to run on a remote UCD agent machine...

GLSA-201701-77 : Ansible: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201701-77 Ansible: Remote execution of arbitrary code An input validation vulnerability was found in Ansibles handling of data sent from client systems. Impact : An attacker with control over a client system being managed by Ansib...

Moxa ioLogik E1200 Series Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-287-05 Moxa ioLogik E1200 Series Vulnerabilities that was published October 13, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 4 -------- Alexandru Ariciu of Applied Risk has identified...

snoopy: incomplete fixes for command execution flaws

Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers...

snoopy: incomplete fixes for command execution flaws

Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers...

Ansible: Remote execution of arbitrary code

Background Ansible is a radically simple IT automation platform. Description An input validation vulnerability was found in Ansible’s handling of data sent from client systems. Impact An attacker with control over a client system being managed by Ansible and the ability to send facts back to the...

CVE-2016-6267

SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 spareCommunity, 2 spareAllowGroupIP, or 3 spareAllowGroupNetmask parameter to...