CVE-2015-0313

Adobe Flash Player is affected by a use-after-free vulnerability (CVE-2015-0313) that enables remote code execution via crafted SWF handling. Affected products include Flash Player versions prior to 13.0.0.269 and 14.x–16.x prior to 16.0.0.305 on Windows/macOS, and prior to 11.2.202.442 on Linux....

CVE-2015-0235

CVE-2015-0235 (GHOST) is a heap-based buffer overflow in glibc’s __nss_hostname_digits_dots() used by gethostbyname/gethostbyname2. Affected glibc versions include 2.2 up to 2.17; patched in glibc-2.18 and later. Exploitation could allow remote or context-dependent arbitrary code execution depend...

CVE-2015-0311

CVE-2015-0311 affects Adobe Flash Player on Windows/macOS up to 16.0.0.287 and Linux 11.2.202.438, described as an unspecified vulnerability that allowed remote code execution via unknown vectors. Exploitation in the wild was reported in January 2015. Connected sources confirm this is a remote-co...

CVE-2015-0310

CVE-2015-0310 is an Adobe Flash Player ASLR bypass vulnerability that allows discovery of memory addresses, bypassing ASLR with implications across affected platforms. Connected advisories confirm remediation by upgrading Flash Player to version 11.2.202.440 (RHSA-2015:0094; OpenSUSE openSUSE-SU-...

CVE-2015-0016

The CVE-2015-0016 issue corresponds to a directory traversal elevation-of-privilege vulnerability in the TS WebProxy (TSWbPrxy) component affecting multiple Windows versions (Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8/8.1, Windows Server 2012/2012 R2, Windows RT/8.1). The und...

CVE-2014-100005

CVE-2014-100005 affects D-Link DIR-600 (revision Bx) routers with firmware before 2.17b02. The vulnerability comprises multiple CSRF flaws that can hijack administrator sessions and perform actions such as creating an admin account, enabling remote management via hedwig.cgi, applying new settings...

CVE-2014-9163

Adobe Flash Player is affected by CVE-2014-9163: a stack-based buffer overflow allows remote code execution. Affected: Windows and OS X Flash Player before 13.0.0.259 and 14.x before 15.0.0.246, and Linux Flash Player before 11.2.202.425. Root cause: stack-based overflow in vulnerable code paths;...

CVE-2014-8439

CVE-2014-8439 describes a dereferenced memory pointer vulnerability in Adobe Flash Player (and related AIR components) that could allow remote code execution. The initial entry lists multiple affected branches: Flash Player versions prior to 13.0.0.258, 14.x, and 15.x before 15.0.0.239 on Windows...

CVE-2014-6324

Summary: CVE-2014-6324 affects the Microsoft Windows Kerberos Key Distribution Center (KDC) used by the Domain, affecting Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7, 8, 8.1, and Server 2012 Gold/R2. The vulnerability stems from improper validation of cryptographic signa...

CVE-2014-1635

Belkin N750 routers are affected by CVE-2014-1635 via a vulnerability in the login.cgi handler of MiniHttpd. A remote attacker can send a crafted long jump parameter to /login.cgi, triggering a buffer overflow and potentially achieve arbitrary code execution. Affected firmware versions include F9...

CVE-2014-6332

CVE-2014-6332 is discussed in connected sources as being exploited by the Neptune Exploit Kit to deliver a Monero-mining payload via Internet Explorer exploits. The Neptune Campaign uses CVE-2014-6332 alongside other IE and Flash exploits to identify vulnerable targets and chain exploits in a sin...

CVE-2014-6321

CVE-2014-6321 is a Microsoft Schannel remote code execution vulnerability affecting Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, Windows 7 SP1, 8/8.1, Server 2012 (Gold/R2) and Windows RT/8.1. The issue arises from improper processing of crafted packets in Schannel, enabling remote cod...

CVE-2014-4077

CVE-2014-4077: Microsoft IME (Japanese) privilege escalation via IMJPDCT.EXE, allowing sandbox bypass when processing crafted PDF files. Affected: Windows XP/Vista/2003/2008/7 with Office 2007/2010/2013 suites; exploited in the wild (2014). Mitigation: apply MS14-078 updates. Connected sources co...

CVE-2014-6352

CVE-2014-6352 is an OLE remote code execution vulnerability in Microsoft Windows where a crafted OLE object can trigger arbitrary code execution. The issue affected Windows Vista SP2, Windows 7 SP1, Windows 8/8.1, Windows Server 2008/2012 variants, and Windows RT, with public exploitation reporte...

CVE-2014-4113

CVE-2014-4113 corresponds to a Windows kernel-win32k.sys local privilege escalation (MS14-058) affecting multiple Windows editions (e.g., Windows 7/8/8.1 and corresponding server variants). The vulnerability arises in win32k.sys kernel-mode drivers and allows a crafted user-mode application to ga...

CVE-2014-4124

CVE-2014-4124 and CVE-2014-4123 affect Microsoft Internet Explorer 7–11 with elevation-of-privilege flaws via a crafted web site. CVE-2014-4123 has public exploitation in the wild (Oct 2014); CVE-2014-4124 is a distinct IE privilege-escalation issue. Affected product: Internet Explorer. Root caus...

CVE-2014-4148

CVE-2014-4148 is a remote code execution vulnerability in Windows kernel-mode driver win32k.sys caused by improper handling of TrueType fonts. It affects multiple Windows versions (server 2003 SP2, Vista, 2008, 7, 8/8.1, Server 2012) and is referenced publicly as MS14-058. Public exploitation exi...

CVE-2014-4123

CVE-2014-4123 affects Microsoft Internet Explorer 7–11. The vulnerability allows remote attackers to gain privileges via a crafted web site (elevation of privilege). Exploitation in the wild was noted in October 2014 (per the CVE description). Mitigation: apply the MS14-056 cumulative update for ...

CVE-2014-4114

CVE-2014-4114 is the Windows OLE Remote Code Execution vulnerability exploited via a crafted OLE object embedded in a Office document. Affected products include Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012 Gold and R2, and Windows RT Gol...

CVE-2014-6287

The vulnerability CVE-2014-6287 affects Rejetto HTTP File Server (HFS) 2.3x prior to 2.3c. It stems from the findMacroMarker function in parserLib.pas, where a null-byte sequence (%00) in a search action allows remote attackers to execute arbitrary code. Public exploits and Metasploit modules exi...