PHP remote file inclusion vulnerability in dompdf.php

This release is superseded by version 0.7.0 This is a security-focused release that addresses a number of vulnerabilities that can expose your system to exploitation. In tandem with this release we have also posted a document to the wiki with advice for securing dompdf. Please read the new docume...

CVE-2014-1261

Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted Unicode font...

Integer overflow

Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted Unicode font...

CVE-2014-1261

CVE-2014-1261 concerns a signedness error in CoreText on Apple OS X Mavericks before 10.9.2. The vulnerability allows remoteCode execution or a denial of service via a crafted Unicode font when applications load fonts, per the NVD description. Affected product: OS X Mavericks (and OS X before 10....

CVE-2014-1261

Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted Unicode font...

PT-2014-4047

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.9.2 Description The issue is related to an integer signedness error in CoreText, which allows remote attackers to execute arbitrary code or cause a denial of service, resulting in an application crash. This can ...

CVE-2014-1261: Undefined Security Weakness

Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted Unicode font...

[DomainHostingView] Show domain hosting information

DomainHostingView is a utility for Windows that collects extensive information about a domain by using a series of DNS and WHOIS queries, and generates HTML report that can be displayed in any Web browser. The information displayed by the report of DomainHostingView includes: the hosting company ...

Notepad++ CCompletion Plugin 1.19 - Local Stack Buffer Overflow

Notepad++ CCompletion Plugin 1.19 - Local Stack Buffer Overflow Application:Notepad++ Version:6.5.2 UNICODE Get the application from: http://notepad-plus-plus.org/download/v6.5.2.html Plugin:CCompletion Version: Version 1.19 Unicode Get the plugin from:...

PT-2020-7548

Name of the Vulnerable Software and Affected Versions: Spring Framework versions prior to 3.2.2 Description: The issue allows remote attackers to conduct cross-site scripting XSS attacks via specific Unicode characters, including line separator, paragraph separator, left angle bracket, or right...

Phabricator: Bypass auth.email-domains (2)

This vulnerability has the same effect as my previously reported bug 2224 Bypass auth.email-domains, but uses a very different approach, bypassing the current fix. Instead of truncating through length, this vulnerability uses truncation via MySQL’s weird behaviour on inserting Unicode characters...

Thinksaas存储型XSS

简要描述： 点击触发，因为多处调用的同一个函数所以多处存在问题 之前还交过一个它的sql注入一个越权。。求审核……审核……核 详细说明： Thinksaas是一款轻量级开源社区系统，界面我很喜欢。官网在http://www.thinksaas.cn/。 因为是一个类似论坛的社区，所以前台难免会有富文本编辑器，而处理不好富文本的话就容易产生XSS。自从看了M老师的文章，我对XSS也有了进一步的认识，所以才能找到Thinksaas过滤不严的XSS。 我们先看它使用的哪个函数对XSS进行的过滤，\thinksaas\tsFunction.php中： / 过滤脚本代码 @param unknow...

GLSA-201402-14 : International Components for Unicode: Denial of Service

The remote host is affected by the vulnerability described in GLSA-201402-14 International Components for Unicode: Denial of Service Multiple vulnerabilities have been discovered in International Components for Unicode. Please review the CVE identifiers referenced below for details. Impact : A...

International Components for Unicode: Denial of service

Background International Components for Unicode is a set of C/C++ and Java libraries providing Unicode and Globalization support for software applications. Description Multiple vulnerabilities have been discovered in International Components for Unicode. Please review the CVE identifiers referenc...

DEBIAN-CVE-2012-6152

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

Pidgin < 2.10.8 Multiple Vulnerabilities

The version of Pidgin installed on the remote host is a version prior to 2.10.8. It is, therefore, potentially affected by the following vulnerabilities : - The bundled version of Pango has an error that can lead to an application crash when rendering fonts and attempting to display certain Unico...

NCH Software Express Burn Plus 4.68 - '.EBP' Project File Buffer Overflow

!/usr/local/bin/perl NCH Software Express Burn Plus 4.68 EBP Project File Handling Buffer Overflow PoC Vendor: NCH Software Product web page: http://www.nchsoftware.com Affected version: 4.68 Summary: Express Burn is a program that allows you to create and copy many kinds of disc media, including...

[Autopsy] Digital Investigation Analysis

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory...

Advanced File Binder: Rakabulle

Advanced File Binder from DarkComet RAT Developer Rakabulle in one word is a file binder from DarkComet RAT Developer with few novel features which could transform a simple binder program to something very complex. What is a file binder? In few words a file binder is a tiny tool which allows...

IBM Forms Viewer Unicode Buffer Overflow

This Metasploit module exploits a stack-based buffer overflow in IBM Forms Viewer. The vulnerability is due to a dangerous usage of strcpy-like function, and occurs while parsing malformed XFDL files, with a long fontname value. This Metasploit module has been tested successfully on IBM Forms...