Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=294 Platform: Win7 32-bit. trigger.cpp should fire the issue, with a caveat - PoC might NOT work if compiled as a debug build. windbg.txt is a sample crash log. Analysis from Nils: --- please find attached a C trigger,...

Schneider Electric StruxureWare Building Expert Security Patch

Industrial control manufacturer Schneider Electric has published new firmware for its StruxureWare Building Expert building automation system that patches a remotely exploitable vulnerability. Researcher Artyom Kurbatov discovered that the system transmits user credentials in plaintext between th...

Synology Video Station Arbitrary Command Execution Vulnerability

Synology Video Station is a video manager from Synology. A security vulnerability exists in Synology Video Station versions prior to 1.5-0763, which can be exploited by remote attackers to execute arbitrary shell commands...

Synology Download Station Cross-Site Scripting Vulnerability (CNVD-2015-06011)

Synology Download Station is a set of web-based download applications from Synology. A cross-site scripting vulnerability exists in the 'Create download task via URL' feature in Synology Download Station prior to version 3.5-2967, which can be exploited by remote attackers to inject arbitrary web...

Synology Download Station Cross-Site Scripting Vulnerability

Synology Download Station is a set of web-based download applications from Synology. A cross-site scripting vulnerability exists in the 'Create download task via file upload' feature of Synology Download Station prior to version 3.5-2962, which can be exploited to inject arbitrary web script or...

Synology Video Station SQL Injection Vulnerability (CNVD-2015-06008)

Synology Video Station is a video manager from Synology. A SQL injection vulnerability exists in Synology Video Station versions prior to 1.5-0757, which can be exploited by remote attackers to execute arbitrary SQL commands...

Synology Video Station SQL Injection Vulnerability (CNVD-2015-06009)

Synology Video Station is a video manager from Synology. A SQL injection vulnerability exists in Synology Video Station versions prior to 1.5-0763, which can be exploited by remote attackers to execute arbitrary SQL commands...

Synology Video Station command injection and multiple SQL injection vulnerabilities

------------------------------------------------------------------------ Synology Video Station command injection and multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Han Sahin, September 2015...

Multiple Cross-Site Scripting vulnerabilities in Synology Download Station

------------------------------------------------------------------------ Multiple Cross-Site Scripting vulnerabilities in Synology Download Station ------------------------------------------------------------------------ Han Sahin, September 2015...

Synology Download Station crossite scripting

Few crossite scripging possibilities...

Synology Video Station security vulnerabilities

SQL injections, commands injection...

CVE-2015-6913

Cross-site scripting XSS vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an addurltask action to dlm/downloadman.cgi...

CVE-2015-6912

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitlecodepage parameter to subtitle.cgi...

CVE-2015-6911

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi...

CVE-2015-6910

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...

CVE-2015-6909

Cross-site scripting XSS vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file...

Sql injection

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi...

Design/Logic Flaw

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitlecodepage parameter to subtitle.cgi...

Cross site scripting

Cross-site scripting XSS vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an addurltask action to dlm/downloadman.cgi...

Sql injection

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...