A remote code execution vulnerability has been reported in Adobe Flash Player. The vulnerability is due to a use-after-free error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file with an affected version of Flash Player.
Category Archives: Checkpoint
Checkpoint
Adobe Flash Player Use After Free Code Execution (APSB16-25: CVE-2016-4173; CVE-2016-4173)
A remote code execution vulnerability exists in Adobe Flash Player. The vulnerability is due to a use-after-free error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file with an affected version of Flash Player.
Adobe Flash Player Memory Corruption (APSB16-25: CVE-2016-4182; CVE-2016-4182)
A memory corruption vulnerability exists in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file.
Tiki Wiki ELFinder Unauthenticated File Upload
An unauthenticated file upload vulnerability exists in Tiki Wiki. By uploading a malicious file to Tiki Wiki, a remote attacker can exploit this vulnerability for execution of arbitrary code in the security context of the web server.
Adobe Acrobat and Reader Memory Corruption (APSB16-14: CVE-2016-1076; CVE-2016-1076)
A memory corruption vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to out-of-bounds error while accessing unintended memory in a specially crafted JPG file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted JPG file in Adobe Acrobat and Reader.
Apache Struts URLValidator Denial of Service (CVE-2016-4465)
A denial of service vulnerability exists in Apache Struts URLValidator. The vulnerability is due to insufficient validation of crafted URLs by the URLValidator. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted HTTP request to a Struts 2 application. Successful attack can result in a denial of service condition.
WordPress Download Manager Plugin Remote Command Execution
A Remote command execution vulnerability exists in WordPress Download Manager Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system.
CGI Namespace Conflict Man-In-The-Middle (httpoxy; CVE-2016-5385; CVE-2016-5386; CVE-2016-5387; CVE-2016-5388; CVE-2016-1000109; CVE-2016-1000110)
Namespace conflict related to HTTP proxy headers allows an attacker to configure the HTTP_PROXY environment variable. A successful exploitation might allow an attacker to launch a man-in-the-middle attack and redirect traffic to an arbitrary host.
Magnitude Exploit Kit Redirection
Magnitude exploit kit is a web exploit kit that operates by delivering malicious payload to the victim’s computer. Remote attackers can infect users with Magnitude exploit kit by enticing them to visit a malicious web page. Successful infection will allow the attacker to perform Remote Code Execution on the victim’s computer.
Nagios XI SQL Injection
An SQL injection vulnerability exists in Nagios XI. It allows an authenticated remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.