Shockwave crossite scripting

Crossite access to cookies and document data is possible...

Write-up by Amit Klein: "Forging HTTP request headers with Flash"

Forging HTTP request headers with Flash Amit Klein, July 2006 Flash - Introduction ==================== Flash player is a very popular browser add-on from Adobe actually, Flash was invented by Macromedia, which was acquired by Adobe. This write-up covers mostly Flash 7 and Flash 8, together...

Crtical Shockwave Embeded XSS Execution

The critical bug Shockwave videos allows to embebded code execution... This code can be XSS or activex mechanism. The victim cant understand because it ll executed background of real video without any redirection or url spoofing.. ====================================== Source Code: There is there...

CVE-2006-3014

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet...

CVE-2006-3014

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet...

Microsoft Office 2003 - Embedded Shockwave Flash Object Security Bypass

Microsoft Office 2003 - Embedded Shockwave Flash Object Security Bypass source: https://www.securityfocus.com/bid/18583/info Microsoft Office is prone to a weakness that may allow remote attackers to execute arbitrary script code contained in Shockwave Flash Objects without first requiring...

CVE-2006-3014

CVE-2006-3014 affects Microsoft Excel where embedding a Shockwave Flash Player ActiveX Object inside an XLS can automatically execute, enabling user-assisted arbitrary JavaScript execution and redirection when the spreadsheet is opened. According to SUSE and CPAI advisories, the issue originates ...

CVE-2006-3014

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet...

Microsoft Office 2003 - Embedded Shockwave Flash Object Security Bypass

source: https://www.securityfocus.com/bid/18583/info Microsoft Office is prone to a weakness that may allow remote attackers to execute arbitrary script code contained in Shockwave Flash Objects without first requiring confirmation from users. A successful attack may allow attackers to access...

CVE-2006-1650

Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: a followup was...

Design/Logic Flaw

Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: a followup was...

CVE-2006-1650

Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: a followup was...

CVE-2006-1650

Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: a followup was...

US-CERT Technical Cyber Security Alert TA06-075A -- Adobe Macromedia Flash Products Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-075A Adobe Macromedia Flash Products Contain Vulnerabilities Original release date: March 16, 2006 Last revised: -- Source: US-CERT Systems Affected Microsoft Windows, Apple Mac OS X,...

Adobe Macromedia Shockwave Player ActiveX installer buffer overflow vulnerability

Overview The ActiveX installer for Adobe Macromedia Shockwave contains a buffer overflow, which may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Shockwave Player Adobe Macromedia Shockwave Player is software that plays active web content...

ShockWave Player ActiveX Installer Buffer Overflow

The remote host contains an ActiveX control associated with Macromedia's ShockWave Player installer that has an exploitable stack-based buffer overflow. It may be possible for an attacker to execute arbitrary code on the remote host subject to the user's privileges by tricking a user into visitin...

Adobe Macromedia Shockwave ActiveX element buffer overflow

Buffer overflow in ActiveX element...

ZDI-06-002: Adobe Macromedia ShockWave Code Execution

ZDI-06-002: Adobe Macromedia ShockWave Code Execution http://www.zerodayinitiative.com/advisories/ZDI-06-002.html February 23, 2006 -- CVE ID: CVE-2005-3525 -- Affected Vendor: Adobe Macromedia -- Affected Products: Macromedia Shockwave Installer -- TippingPointTM IPS Customer Protection:...

CVE-2005-3525

CVE-2005-3525 corresponds to a stack-based buffer overflow in the Shockwave Player ActiveX installer (ActiveX control used to install Shockwave). The flaw exists in the installer ActiveX control and can be exploited by supplying crafted large values to two parameters, enabling remote code executi...

CVE-2005-3525

Stack-based buffer overflow in an ActiveX control for the installer for Adobe Macromedia Shockwave Player 10.1.0.11 and earlier allows remote attackers to execute arbitrary code via crafted large values for unspecified parameters...