A denial of service vulnerability exists in Apache Struts URLValidator. The vulnerability is due to insufficient validation of crafted URLs by the URLValidator. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted HTTP request to a Struts 2 application. Successful attack can result in a denial of service condition.
Category Archives: Checkpoint
Checkpoint
WordPress Download Manager Plugin Remote Command Execution
A Remote command execution vulnerability exists in WordPress Download Manager Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system.
Adobe Flash Player Use After Free Code Execution (APSB16-25: CVE-2016-4248; CVE-2016-4248)
A remote code execution vulnerability exists in Adobe Flash Player. The vulnerability is due to a use-after-free error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file with an affected version of Flash Player.
Adobe Flash Player Use After Free Code Execution (APSB16-25: CVE-2016-4222; CVE-2016-4222)
A remote code execution vulnerability exists in Adobe Flash Player. The vulnerability is due to a use-after-free error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file with an affected version of Flash Player.
Adobe Flash Player Memory Corruption (APSB16-25: CVE-2016-4232; CVE-2016-4232)
A memory leak vulnerability exists in Adobe Flash Player. The vulnerability is due to a dangling reference error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file with an affected version of Flash Player.
Adobe Flash Player Use After Free Code Execution (APSB16-25: CVE-2016-4174; CVE-2016-4174)
A remote code execution vulnerability has been reported in Adobe Flash Player. The vulnerability is due to a use-after-free error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file with an affected version of Flash Player.
Adobe Flash Player Use After Free Code Execution (APSB16-25: CVE-2016-4173; CVE-2016-4173)
A remote code execution vulnerability exists in Adobe Flash Player. The vulnerability is due to a use-after-free error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file with an affected version of Flash Player.
CGI Namespace Conflict Man-In-The-Middle (httpoxy; CVE-2016-5385; CVE-2016-5386; CVE-2016-5387; CVE-2016-5388; CVE-2016-1000109; CVE-2016-1000110)
Namespace conflict related to HTTP proxy headers allows an attacker to configure the HTTP_PROXY environment variable. A successful exploitation might allow an attacker to launch a man-in-the-middle attack and redirect traffic to an arbitrary host.
Magnitude Exploit Kit Redirection
Magnitude exploit kit is a web exploit kit that operates by delivering malicious payload to the victim’s computer. Remote attackers can infect users with Magnitude exploit kit by enticing them to visit a malicious web page. Successful infection will allow the attacker to perform Remote Code Execution on the victim’s computer.
Squid Long String Header Processing Assertion Failure (CVE-2016-2569)
A denial-of-service vulnerability has been reported in Squid. The vulnerability is due to the way Squid uses a String object of a certain maximum length to store incoming headers, such as the Vary header, in HTTP responses. Long strings in headers can cause an assertion failure.