Boxoft Wav 1.0 - Buffer Overflow

Document Title: =============== Boxoft Wav v1.1.0.0 - Buffer Overflow Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2027 Release Date: ============= 2017-01-09 Vulnerability Laboratory ID VL-ID: ==================================== 2027...

Boxoft Wav v1.1.0.0 - Buffer Overflow Vulnerability

Document Title: =============== Boxoft Wav v1.1.0.0 - Buffer Overflow Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2027 Release Date: ============= 2017-01-09 Vulnerability Laboratory ID VL-ID: ==================================== 2027...

Boxoft Wav v1.1.0.0 - Buffer Overflow Vulnerability

Document Title: =============== Boxoft Wav v1.1.0.0 - Buffer Overflow Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2027 Release Date: ============= 2017-01-09 Vulnerability Laboratory ID VL-ID: ==================================== 2027...

UBUNTU-CVE-2017-5196

Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service out-of-bounds read and crash via vectors involving strings that are not UTF8...

FLARE Script Series: Querying Dynamic State using the FireEye Labs Query-Oriented Debugger (flare-qdb)

Introduction This post continues the FireEye Labs Advanced Reverse Engineering FLARE script series. Here, we introduce flare-qdb, a command-line utility and Python module based on vivisect for querying and altering dynamic binary state conveniently, iteratively, and at scale. flare-qdb works on...

UBUNTU-CVE-2014-9912

The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service buffer overflow or possibly have...

Python's new string format vulnerability analysis-vulnerability warning-the black bar safety net

This article on Python introduced a formatted string of the new syntax of the security vulnerabilities in-depth analysis, and provide appropriate security solutions. When we are on untrusted user input using str. the format of the time, will bring security risks-for this problem, in fact I have...

Debian DLA-761-2 : python-bottle regression update

The update for python-bottle issued as DLA 761-1 would cause a crash if a unicode string was used in a header. Updated packages are now available to correct this issue. For Debian 7 'Wheezy', these problems have been fixed in version 0.10.11-1+deb7u3. We recommend that you upgrade your...

Moderate: Red Hat Security Advisory: openstack-cinder, openstack-glance, and openstack-nova update

An update for openstack-nova, openstack-cinder, and openstack-glance is now available for Red Hat OpenStack Platform 8.0 Liberty. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Multiple Apple Products ICU Component Arbitrary Code Execution Vulnerability

Apple iOS, watchOS, macOS, and tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; watchOS is a smartwatch operating system; ICU is a Unicode-enabled, software internationalization, globalization C/C++ and Java library. A security vulnerability exists in...

Cross-Site Scripting (XSS)

gon is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript when prepended with certain unicode characters...

Man In The Middle (MitM)

unicode is vulnerable to man-in-the-middle MitM attacks. This is because the library downloads binary resources via HTTP, allowing MitM attacks. It may also cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or...

libxml2: out-of-bounds read

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service out-of-bounds read and application crash via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627...

Hand to hand teach you how to construct the office exploits EXP（fourth period）-bug warning-the black bar safety net

This is a period of vulnerability to share with you is CVE-2015-1641 learning summary, this vulnerability due to its good versatility and stability claims to have replaced the CVE-2012-0158 trend. The vulnerability is a type confusion class of vulnerability, through which you can achieve arbitrar...

icu: Heap-buffer-overflow in utext_previous32_58

Project: https://github.com/unicode-org/icu.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5560648738013184 Project: icu Fuzzer: libFuzzericuucasemapfuzzer Fuzz target binary: ucasemapfuzzer Job Type: libfuzzerasanicu Platform Id: linux Crash Type: Heap-buffer-overflow...

Downloads Resources over HTTP

Overview Affected versions of unicode-json insecurely downloads resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on...

Downloads Resources over HTTP

Overview Affected versions of unicode insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the...

WordPress: XSS via unicode characters in upload filename

Wordpress has a vulnerability that could lead to javascript execution and thus privileged escalation via an admin visiting the wrong page via specially crafted JavaScript. Unicode characters are escaped by javascript but they are not escaped serverside. I've checked the latest version 4.6.1 at th...

openSUSE Security Update : kde-cli-tools5 (openSUSE-2016-1171)

This update for kde-cli-tools5 fixes the following vulnerability : - CVE-2016-7787: user could sneak an unicode string terminator in the kdesu invocation boo1001916 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

OPENSUSE-SU-2016:2498-1 Security update for kde-cli-tools5

This update for kde-cli-tools5 fixes the following vulnerability: CVE-2016-7787: user could sneak an unicode string terminator in the kdesu invocation boo1001916...