jackson-databind: arbitrary code execution in slf4j-ext class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code...

WS-2019-0385

In php-src, “ext/exif/exif.c” php-4.0.1RC to php-7.4.0beta2 are vulnerable to DOS attack due to lack of appropriate handling of error messages...

E2fsprogs Buffer Overflow Vulnerability

E2fsprogs is a set of utility programs for maintaining ext2, ext3 and ext4 file systems. A buffer overflow vulnerability exists in E2fsprogs versions 1.43.3 through 1.45.3, which can be exploited to execute code via a corrupted partition...

libsolv: NULL pointer dereference in function testcase_read

There is a NULL pointer dereference at ext/testcase.c function testcaseread in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service...

libsolv: NULL pointer dereference in function testcase_str2dep_complex

There is a NULL pointer dereference at ext/testcase.c function testcasestr2depcomplex in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service...

PT-2019-13130 · Denx Software Engineering +2 · Das U-Boot +2

Name of the Vulnerable Software and Affected Versions: Das U-Boot versions 2016.09 through 2019.07-rc4 Description: The issue arises when Das U-Boot attempts to read a crafted ext4 filesystem, leading to a stack buffer overflow due to excessive data being memset. This overflow could potentially...

PHP 'ext/exif/exif.c' Denial of Service Vulnerability

Description PHP is prone to a denial-of-service vulnerability. Successful exploits may allow the attacker to crash the affected application resulting in denial-of-service condition. Versions prior to PHP 7.4.0 are vulnerable. Technologies Affected PHP PHP 7.3.0 PHP PHP 7.3.1 PHP PHP 7.3.2 PHP PHP...

jackson-databind: arbitrary code execution in slf4j-ext class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code...

PT-2019-13038

Name of the Vulnerable Software and Affected Versions LiveZilla Server versions prior to 8.0.1.1 Description The issue concerns SQL Injection in the server.php file via the p ext rse parameter. Recommendations For versions prior to 8.0.1.1, update to version 8.0.1.1 or later to resolve the issue...

PT-2019-16093

Name of the Vulnerable Software and Affected Versions Android versions 7.0 through 9 Description The issue is related to a missing bounds check in the phNxpNciHal process ext rsp function of phNxpNciHal ext.cc, which could lead to a possible out-of-bound write. This could result in local escalati...

Directory traversal

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "getfile.sh" which allows a user to retrieve any file stored in the "cmh-ext" folder on the device. However, the "filename" parameter is not validated correctly and this allows a...

@devsisters/passport (>=1.1.0, <=1.1.2), @project-sunbird/ext-framework-server (8.0.0) +4 more potentially affected by CVE-2019-10157 via keycloak-connect (>=4.0.0-beta.1, <=4.5.0)

keycloak-connect NPM version =4.0.0-beta.1, =1.1.0, =0.0.2, =0.0.1, =0.0.1-alpha-1, =1.2.7 Source cves: CVE-2019-10157 Source advisory: OSV:GHSA-68HW-VFH7-XVG8...

CVE-2019-12458

FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01...

CVE-2019-12458: Improper Limitation of a Pathname to a Restricted Directory

FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01...

PT-2019-12804

Name of the Vulnerable Software and Affected Versions FileRun versions prior to 2019.06.01 Description The issue allows directory listing in the css/ext-ux directory. This has been fixed in a later version. Recommendations For versions prior to 2019.06.01, update to version 2019.06.01 or later to...

UBUNTU-CVE-2019-11059

Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow...

Arbitrary Code Execution

php is vulnerable to arbitrary code execution. Mishandling of \0 characters in the pharanalyzepath function in ext/phar/phar.c allows an attacker to execute arbitrary code...

Information Disclosure

php is vulnerable to information disclosure. The vulnerability exists as the phpinfo implementation in ext/standard/info.c does not ensure use of the string data type for the PHPAUTHPW, PHPAUTHTYPE, PHPAUTHUSER, and PHPSELF...

Design/Logic Flaw

Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10302

Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...