182 matches found
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a...
FLARE Script Series: Querying Dynamic State using the FireEye Labs Query-Oriented Debugger (flare-qdb)
Introduction This post continues the FireEye Labs Advanced Reverse Engineering FLARE script series. Here, we introduce flare-qdb, a command-line utility and Python module based on vivisect for querying and altering dynamic binary state conveniently, iteratively, and at scale. flare-qdb works on...
Debian DLA-761-2 : python-bottle regression update
The update for python-bottle issued as DLA 761-1 would cause a crash if a unicode string was used in a header. Updated packages are now available to correct this issue. For Debian 7 'Wheezy', these problems have been fixed in version 0.10.11-1+deb7u3. We recommend that you upgrade your...
openSUSE Security Update : kde-cli-tools5 (openSUSE-2016-1171)
This update for kde-cli-tools5 fixes the following vulnerability : - CVE-2016-7787: user could sneak an unicode string terminator in the kdesu invocation boo1001916 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
OPENSUSE-SU-2016:2498-1 Security update for kde-cli-tools5
This update for kde-cli-tools5 fixes the following vulnerability: CVE-2016-7787: user could sneak an unicode string terminator in the kdesu invocation boo1001916...
VUPlayer 2.49 - (.wax) Buffer Overflow Vulnerability
Product & Service Introduction: =============================== VUPlayer is a freeware multi-format audio player for windows. Copy of the Vendor Homepage: http://vuplayer.com/vuplayer.php Technical Details & Description: ================================ The classic buffer overflow vulnerability i...
VUPlayer 2.49 - (.pls) Buffer Overflow Vulnerability
VUPlayer is a freeware multi-format audio player for windows. Copy of the Vendor Homepage: http://vuplayer.com/vuplayer.php Technical Details & Description: ================================ The classic buffer overflow vulnerability is located in the software VUPlayer an attacker can manipulate th...
UBUNTU-CVE-2015-8790
The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access...
The vulnerability of the Mac OS X operating system allows a perpetrator to execute arbitrary code or cause a service failure.
The vulnerability of the Speech UI component in the Mac OS X operating system arises due to buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure by using a specially crafted Unicode string...
Apple OS X Speech UI Memory Corruption Vulnerability
Apple OS X is a BSD-based operating system distributed by Apple. A memory corruption vulnerability exists in the Apple OS X Speech UI, which allows remote attackers to exploit the vulnerability by submitting a special Unicode string and tricking an application into parsing it, which can execute...
CVE-2015-3794
The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted Unicode string...
Design/Logic Flaw
The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted Unicode string...
CVE-2015-3794
The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted Unicode string...
UBUNTU-CVE-2015-1609
MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request...
CVE-2015-0925
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname...
Design/Logic Flaw
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname...
CVE-2015-0925
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname...
Oracle Linux 6 : perl (ELSA-2011-1424)
The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1424 advisory. - 731246 CVE-2011-2939CVE-2011-2939 heap overflow - decoding Unicode string Tenable has extracted the preceding description block directly from the...
Buffer overflow
Multiple buffer overflows in FlashFXP.exe in FlashFXP 4.2 allow remote authenticated users to execute arbitrary code via a long unicode string to 1 TListbox or 2 TComboBox...