Open-Xchange Guard version 2.0 suffers from a cross site scripting vulnerability.
888154affc2ef5c3a8d0c97e1dc560312910892473344310de9e89d6ca8fcd4cGentoo Linux Security Advisory 201511-2 - Multiple vulnerabilities have been found in Adobe Flash Player, the worst of which allows remote attackers to execute arbitrary code. Versions less than 11.2.202.548 are affected.
e6845cf2bd6a0e075d4dc6bfd3258c520129150cb19c3a4b1781f97ae1ad7e3bFree WMA MP3 Converter version 1.8 suffers from a buffer overflow vulnerability.
405e1a5c47ed2d7f68d824586599986b2c40de899c0466366ebf697fa61505deMurgent CMS from 2015Q4 suffers from a remote SQL injection vulnerability.
3d3c1ae69315f62677ef5cb67d8cd395a1393075c74dfc1d329ba7fc8f456883LineNity WP premium theme suffers from a local file inclusion vulnerability.
aedb3c213591ef0023a5bac52d0988f5003d14829fbb8554821e52c538078db3Ebay Magento suffered from multiple cross site request forgery vulnerabilities.
9100b8e6174a98fe814cca49771a623e8ed97ea3ca97aba563a8cdfb93846e04Ebay Magento Commerce suffered from a cross site scripting vulnerability.
d053d31a2e30a77f10b17da4ec3786d918f2e3f72ec4c69bda9bb8bedc20b230Lan Scan HD version 1.20 suffers from a command injection vulnerability.
a6f4b3a9396e8402950f0d05045b64e5fa21dea5031ee2933070b42412e31732Port Scan version 2.0 suffers from a command injection vulnerability.
e0354f5b75c9099132633c4b052838d46b8bbee6c82c53020df95d4ea18525b4Bluto is a dns reconnaissance, vulnerability checking, and enumeration tool.
431c6f71e045b8def154280f8fbd6fb5f8dd6b7b32299a86768ff218522a8265PHP Address Book version 8.2.5.2 suffers from a remote SQL injection vulnerability.
74ce6b4fbc3365f91ad208910228a3874d6c832b0bfb7575b3a009ca64d52058On Microsoft Windows you can create NTFS hardlinks without needing write permissions on the target file.
760348b2c259a8688b4643226d703dcb86c3811fe54ead7f25e0acc81110138dzTree version 3.5.19.1 suffers from a cross site scripting vulnerability.
74c4694fccb338eef0b0a66ddd1bd35451475c0c7f74ebe8ff6a29b02a59712fA number of Windows kernel crashes in the win32k.sys driver exist while processing a specific corrupted TTF font file. This finding documents an overflow with a malformed OS/2 table.
8fe968ce622cf9113f76404623b7e14a9b2abf8080a96adb4115cbf39cfdec56Fuzzing the RAR file format found multiple crashes, some of which are obviously exploitable for remote code execution as NT AUTHORITY\\SYSTEM on any system with Kaspersky Antivirus.
840a6644fa6473e395e71ccc99acd288e2ea564ff3edbc779548159cd42980dfThe Cisco FireSIGHT Management Center appliance suffers from a certificate validation vulnerability. FirePWNER exploit included. Versions affected include 5.2.x, 5.3.x, and 5.4.x.
3fc2f6862036f1dcec916cfa817e09ceabd99af239e63cb74877b949a1537809The ACL on %PROGRAMDATA%\Kaspersky Lab allows BUILTIN\Users to create new files. This can be abused to create new plugins and modules during update, and other filesystem races to gain elevated privileges.
5123890ee94b7febd160cd7bdcce88da33225fd6e226283bf65d0ea4999f84e3The attached testcase was found by fuzzing DEX files, and results in a heap overflow with a wild memcpy. Note that Kaspersky catch exceptions and continue execution, so running into unmapped pages doesn't terminate the process, this should make exploitation quite realistic.
6751e071bf8dd3497577b29fbf7d097aa98be4740d9f645d2afa24cded401776BSidesCharm 2016 has announced its Call For Papers. It will be held in Baltimore, MD, USA April 23rd through the 24th, 2016.
48cc7c98a1bb52a5c1c079a1de9041accf0850c7a5363cb2ab610746fa6409fbAdobe Reader X and XI for Windows suffer from an out-of-bounds read in CoolType.dll.
bc8c45d0bc029bbfe2dcb8a7c8653db43d3be01d2877e59509fb180abdbeb922On Windows 8.1 Update 32/64 bit, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function AhcVerifyAdminContext. This function has a vulnerability where it doesn't correctly check the impersonation token of the caller to determine if the user is an administrator. It reads the caller's impersonation token using PsReferenceImpersonationToken and then does a comparison between the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level of the token so it's possible to get an identify token on your thread from a local system process and bypass this check.
72088e382599651c32cb9cdc5567e22509289abb4b5d97381967f2aafa755155TECO JN5 L510-DriveLink version 1.482 suffers from a vulnerability that is caused due to a boundary error in the processing of a project file, which can be exploited to cause a buffer overflow when a user opens e.g. a specially crafted .LF5 file. Successful exploitation could allow execution of arbitrary code on the affected machine.
0a17862b17b3d467c4d8f98421a8360fdbcb7dc4e4083cf422ec3cebfc1dcc18TECO AP-PCLINK version 1.094 suffers from a vulnerability that is caused due to a boundary error in the processing of a project file, which can be exploited to cause a buffer overflow when a user opens e.g. a specially crafted .TPC file. Successful exploitation could allow execution of arbitrary code on the affected machine.
05a9e596617eb5f861cd0aa93ea5277f10981c522596b213248bf09866d332c4TECO SG2 FBD Client version 3.51 suffers from a vulnerability that is caused due to a boundary error in the processing of a Genie FBD, which can be exploited to cause a buffer overflow when a user opens e.g. a specially crafted .GFB file. Successful exploitation could allow execution of arbitrary code on the affected machine.
9e734f6542911311ba1c133e0986c8e5fe18cf3fbb2d5b7622a8b4a411038008networkd is the system daemon which implements the com.apple.networkd XPC service. It's unsandboxed but runs as its own user. com.apple.networkd is reachable from many sandboxes including the Safari WebProcess and ntpd (plus all those which allow system-network). networkd parses quite complicated XPC messages and there are many cases where xpc_dictionary_get_value and xpc_array_get_value are used without subsequent checking of the type of the returned value.
8f3b0d4e8a89ad64284b0b7f58567f82fed3eee85dac017382e0f65c2b11a7e5
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed