Adobe Flash Player ActionScript launch command execution

Added: 01/07/2008 CVE: CVE-2008-5499 BID: 32896 OSVDB: 50796 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem An input validation vulnerability allows command execution when the browser loads an SWF file which contains shell...

Adobe Flash Player ActionScript launch command execution

Added: 01/07/2008 CVE: CVE-2008-5499 BID: 32896 OSVDB: 50796 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem An input validation vulnerability allows command execution when the browser loads an SWF file which contains shell...

Adobe Flash Player ActionScript launch command execution

Added: 01/07/2008 CVE: CVE-2008-5499 BID: 32896 OSVDB: 50796 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem An input validation vulnerability allows command execution when the browser loads an SWF file which contains shell...

CVE-2007-6637

Multiple cross-site scripting XSS vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by...

CVE-2007-6637

Multiple cross-site scripting XSS vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by...

CVE-2007-6637

Multiple cross-site scripting XSS vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by...

CVE-2007-6637

CVE-2007-6637 is a cross-site scripting (XSS) vulnerability in Adobe Flash Player triggered by crafted SWF files, enabling remote script/HTML execution via SWF parameters. The issue is discussed alongside related CVEs (e.g., CVE-2007-6244) and is reflected in Red Hat advisories for Flash Player, ...

XSS Vulnerabilities in Common Shockwave Flash Files

Hi. Recently, there has been news regarding Flash authoring tools and XSS, but the articles contained little technical information. So, I created a detailed report at: http://docs.google.com/Doc?docid=ajfxntc4dmsq14dt57ssdw An abbreviated version intended for full-disclosure, bugtraq, and...

Flash authoring tools create Flash files that contain cross-site scripting vulnerabilities

Overview A number of authoring tools for Flash content may generate files that contain cross-site scripting vulnerabilities. Any site hosting Flash generated by an affected tool could be vulnerable to cross-site scripting. Description ActionScript is a scripting language based on ECMAScript also...

Dreamweaver中的Adobe Flash Player SWFs和Acrobat存在跨站脚本漏洞

BUGTRAQ ID: 27034 CNCAN ID:CNCAN-2007122701 Adobe Flash Player是一款流行的FLASH播放程序，Acrobat是一款PDF处理程序。 SWF文件中存在多个跨站脚本问题，远程攻击者可以利用漏洞获得目标用户敏感信息。 问题存在于Adobe Dreamweaver CS3和Adobe Acrobat connect中，目前没有详细漏洞细节提供。 Adobe Flash Player Plugin 9.0.31 .0 Adobe Flash Player Plugin 9.0.28 .0 Adobe Flash Player Plugi...

RealPlayer 10.5 (6.0.12.1040-1348) SWF Buffer Overflow PoC

No description provided by source. !/usr/bin/perl RealPlayer: Buffer overflow vulnerability / PoC CVE-2006-0323 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323 RealNetworks Advisory http://service.real.com/realplayer/security/03162006player/en/ Federico L. Bossi Bonin ...

Adobe Flash Player ActionScript SecurityErrorEvent绕过安全限制漏洞

BUGTRAQ ID: 25260 CVECAN ID: CVE-2007-4324 Flash Player是一款非常流行的FLASH播放器。 Flash Player中的ActionScript 3（AS3）允许远程攻击者通过指定了连接的SWF电影绕过安全沙盒模型获得敏感信息并端口扫描任意主机，然后使用SecurityErrorEvent错误的定时差异判断端口是否开放。 AS3 Adobe引入了新的套接字相关事件SecurityErrorEvent。当Flash Player试图连接到关闭的TCP端口时会立即出现SecurityErrorEvent，如果服务在监听该端口Flash...

Adobe Flash Player JPG头处理远程堆缓冲区溢出漏洞

BUGTRAQ ID: 26951 CVE ID：CVE-2007-6242 CNCVE ID:CNCVE-20076242 Adobe Flash Player是一款流行的FLASH播放程序。 Adobe Flash Player解析SWF文件中嵌入的JPG图象存在问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 Flash播放器信任有符号的JPG头字段中指定的X和Y密度，并根据此值分配内存，但后续的循环处理过程中这些值以无符号值对待，可导致过多的循环迭代而在解码图象过程中造成堆破坏，精心构建图象数据，诱使用户打开，可导致以应用程序进程权限执行任意指令。 RedHat...

Adobe Flash Player ActiveX控件通用跨站脚本漏洞

Adobe Flash Player是一款流行的FLASH播放程序。 Adobe Flash Player包含的ActiveX控件处理navigateToURL API存在缺陷，远程攻击者可以利用漏洞进行跨站脚本攻击，可获得敏感信息或进行其他攻击。 navigateToURL API函数接收两个参数，URL和要浏览的帧名，SWF动画可在javascript: URI中传递而帧名可是其他域的帧名，这可导致URI执行在其他帧安全上下文中执行，攻击者可以构建恶意WEB页，诱使用户访问来触发。 RedHat Enterprise Linux Supplementary v.5 server...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via 1 a SWF file that uses the asfunction: protocol or 2 the navigateToURL function when used with the Flash Player Activ...

CVE-2007-6244

Multiple cross-site scripting XSS vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via 1 a SWF file that uses the asfunction: protocol or 2 the navigateToURL function when used with the Flash Player Activ...

CVE-2007-6244

Multiple cross-site scripting XSS vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via 1 a SWF file that uses the asfunction: protocol or 2 the navigateToURL function when used with the Flash Player Activ...

Flash Player < 7.0.73.0 / 9.0.115.0 Multiple Vulnerabilities (APSB07-20)

According to its version number, the instance of Flash Player on the remote Windows host is affected by multiple issues, including several which could allow for arbitrary code execution by means of a malicious SWF file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

linux-flashplugin -- multiple vulnerabilities

Adobe Security bulletin: Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to...