1360 matches found
Microsoft Windows XP/95/98/2000/NT 4 Riched20.dll Attribute Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6874/info The riched20.dll is vulnerable to a buffer overflow that results in the application calling the library to fail. By creating a Rich Text Format RTF file with more than 65536 bytes of data in an attribute, the...
Viewpoint Media Player for IE 3.2 - Remote Stack Overflow PoC
No description provided by source. pre codespan style=font: 10pt Courier New;span class=general1-symbolbody bgcolor=E0E0E0----------------------------------------------------------------------------- bViewpoint Media Player for IE 3.2 AxMetaStream.dll Remote Stack Overflow/b url:...
ThinkSAAS 2.2-beta 存储型XSS
简要描述： 富文本过滤不严格导致可植入恶意脚本盗取用户cookies 详细说明： 对比了一下 WooYun: Thinksaas存储型XSS ，发现确实更新了。我就无耻的来了。 下面是对富文本过滤的代码片段： function cleanJs$text $text = trim $text ; //$text = stripslashes $text ; // 完全过滤注释 $text = pregreplace '//', '', $text ; // 完全过滤动æ€ä»£ç $text = pregreplace '//', '',...
[oss-security] Mumble 1.2.6: Mumble-SA-2014-005 and Mumble-SA-2014-006
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi oss-security, The Mumble team has just released Mumble 1.2.6, which contains fixes for the two following vulnerabilities: Mumble-SA-2014-005 http://mumble.info/security/Mumble-SA-2014-005.txt - SVG images with local file references could trigger...
DEBIAN-CVE-2010-5109
Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service crash via a crafted TNEF file, which triggers a buffer overflow...
Advance Notification Service for the April 2014 Security Bulletin Release
Today we provide advance notification for the release of four bulletins, two rated Critical and two rated Important in severity. These updates address issues in Microsoft Windows, Office and Internet Explorer. The update provided through MS14-017 fully addresses the Microsoft Word issue first...
Microsoft Word RTF Drawing Primitives Remote Code Execution (MS08-072) - Ver2 (CVE-2008-4028)
Rich Text Format RTF provides a format for text and graphics interchange that can be used with different operating systems. OLE is the technology that applications use to create and edit compound documents. By using OLE technology, an application can provide embedding and linking support. A remot...
Microsoft Word RTF Control Word Handling Integer Overflow (MS08-072) - Ver2 (CVE-2008-4025)
Rich Text Format RTF provides a format for text and graphics interchange that can be used with different operating systems. OLE is the technology that applications use to create and edit compound documents. By using OLE technology, an application can provide embedding and linking support. A remot...
destoon最新版某敏感功能xss指哪打哪
简要描述： 之前提交过，官方说补了 http://www.wooyun.org/bugs/wooyun-2014-053573 于是我看看修补以后的效果。 详细说明： 这是最新版的过滤富文本xss的函数： 已经解决了之前的问题。用expressi0n替换了expression。看似似乎没问题了。 其实还有各种问题。IE还有一个容错特性，那就是expression，其中加斜杠\，在IE6789上是可以触发的（当然我没测试更高版本）。所以，利用这个特性，可以绕过dsafe函数的过滤。 这时候，我们测试： 照弹无误：...
ThinkSNS存储型XSS一枚
简要描述： 存储型XSS 详细说明： thinksns在微吧的应用中，允许用户发表帖子，而帖子是富文本。 所以，不可避免地涉及到富文本中xss的过滤。而问题就出来过滤的地方。 thinksns使用如下函数过滤传入的参数 function h$text, $type = 'html' // 无标签格式 $texttags = ''; //只保留链接 $linktags = ''; //只保留图片 $imagetags = ''; //只存在字体样式 $fonttags = ''; //标题摘要基本格式 $basetags = $fonttags.' '; //兼容Form格式...
Microsoft Releases Security Advisory 2953095
Today we released Security Advisory 2953095 to notify customers of a vulnerability in Microsoft Word. At this time, we are aware of limited, targeted attacks directed at Microsoft Word 2010. An attacker could cause remote code execution if someone was convinced to open a specially crafted Rich Te...
PT-2014-1206 · Microsoft · Sharepoint Server +6
Name of the Vulnerable Software and Affected Versions: Microsoft Word versions 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT Word Viewer Office Compatibility Pack version SP3 Office for Mac version 2011 Word Automation Services on SharePoint Server versions 2010 SP1 and SP2 and 2013...
Microsoft Word RTF Object Parsing Remote Code Execution (MS08-072) - Ver2 (CVE-2008-4027)
Microsoft Word is a popular word processing software. A remote code execution vulnerability has been identified in Microsoft Word. The vulnerability is due to a memory calculation error in Microsoft Word that fails to properly handle specially crafted control words in Rich Text Format .rtf files....
Thinksaas存储型XSS
简要描述： 点击触发，因为多处调用的同一个函数所以多处存在问题 之前还交过一个它的sql注入一个越权。。求审核……审核……核 详细说明： Thinksaas是一款轻量级开源社区系统，界面我很喜欢。官网在http://www.thinksaas.cn/。 因为是一个类似论坛的社区，所以前台难免会有富文本编辑器，而处理不好富文本的话就容易产生XSS。自从看了M老师的文章，我对XSS也有了进一步的认识，所以才能找到Thinksaas过滤不严的XSS。 我们先看它使用的哪个函数对XSS进行的过滤，\thinksaas\tsFunction.php中： / 过滤脚本代码 @param unknow...
[Subterfuge v1.0] Automated Man-in-the-Middle Attack Framework
Subterfuge , a Framework to take the arcane art of Man-in-the-Middle Attacks and make it as simple as point and shoot. Subterfuge demonstrates vulnerabilities in the ARP Protocol by harvesting credentials that go across the network and even exploiting machines by injecting malicious code directly...
Rich Mogull on the Target Data Breach
Dennis Fisher talks with Rich Mogull of Securosis about the Target data breach, how the attack may have worked, why these breaches are still so common and what can be done to improve the situation...
Debian DSA-2841-1 : movabletype-opensource - XSS
A cross-site scripting vulnerability was discovered in the rich text editor of the Movable Type blogging engine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2841. The text itself is...
Debian Security Advisory DSA 2841-1 (movabletype-opensource - cross-site scripting)
A cross-site scripting vulnerability was discovered in the rich text editor of the Movable Type blogging engine. OpenVAS Vulnerability Test $Id: deb2841.nasl 6715 2017-07-13 09:57:40Z teissa $ Auto-generated from advisory DSA 2841-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks...
CVE-2014-0977
Cross-site scripting XSS vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
UBUNTU-CVE-2014-0977
Cross-site scripting XSS vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...