CVE-2017-2654: Exposure of Sensitive Information to an Unauthorized Actor

jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emai...

CVE-2018-14884

An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because httpheadervalue in ext/standard/httpfopenwrapper.c can be a NULL value that is mishandled in an atoi call...

PT-2018-3784

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.37 PHP versions 7.0.x prior to 7.0.31 PHP versions 7.1.x prior to 7.1.20 PHP versions 7.2.x prior to 7.2.8 Description The issue is related to the linkinfo function in the ext/standard/link win32.c component of the PH...

CVE-2018-14884: NULL Pointer Dereference

An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because httpheadervalue in ext/standard/httpfopenwrapper.c can be a NULL value that is mishandled in an atoi call...

PT-2018-2650

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.37 PHP versions 7.0.x prior to 7.0.31 PHP versions 7.1.x prior to 7.1.20 PHP versions 7.2.x prior to 7.2.8 Description The issue is related to the exif process IFD in MAKERNOTE function in the ext/exif/exif.c file,...

Linux kernel out-of-bounds access vulnerability (CNVD-2018-24382)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. ext4 filesystem is one of the ext4 filesystem components. A security vulnerability exists in the ext4 filesystem of the Linux kernel. The vulnerability can be exploited to cau...

CVE-2018-8046

The getTip method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip method of Action Column...

Cross site scripting

The getTip method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip method of Action Column...

CVE-2018-8046

The getTip method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip method of Action Column...

CVE-2018-8046

The getTip method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip method of Action Column...

CVE-2018-8046

The CVE-2018-8046 issue affects Sencha Ext JS 4–6 prior to 6.6.0. The getTip() method in Action Columns unescapes HTML-escaped data, enabling cross-site scripting if tooltips contain user-controlled content. Public information confirms vulnerability details and that a fix was released in 6.6.0 (w...

PT-2018-18404

Name of the Vulnerable Software and Affected Versions: Sencha Ext JS versions 4 through 6.5.3 Description: The issue concerns the getTip method of Action Columns, which is susceptible to cross-site scripting XSS attacks. This occurs even when HTML-escaped data is passed, as the method un-escapes...

CVE-2018-8046: Improper Neutralization of Input During Web Page Generation

The getTip method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip method of Action Column...

extjs getTip() Cross Site Scripting Vulnerability

Exploit for jsp platform in category web applications A XSS vulnerability exists in the getTip method of Action Columns. The Ext JS framework brings no built-in XSS protection, meaning that developers are responsible for sanitizing their output. However. the method above takes HTML-escaped data a...

DEBIAN-CVE-2018-12928

In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfsextreadextent in hfs.ko. This can occur during a mount of a crafted hfs filesystem...

PHP 7.2.x <= 7.2.7 DoS Vulnerability

PHP is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription...

CVE-2018-12882

exifreadfromimpl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free in exifreadfromfile because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exifreaddata function...

PT-2018-3786

Name of the Vulnerable Software and Affected Versions PHP versions 5.x through 7.1.24 Description The issue is related to a flaw in the deserialization mechanism of the PHP interpreter, specifically in the ext/standard/var unserializer.c component. This flaw can be exploited by a remote attacker ...

PT-2018-3787

Name of the Vulnerable Software and Affected Versions PHP versions 5.x through 7.1.24 Description The issue is related to errors in pointer dereferencing in the PHP interpreter, specifically in the ext/standard/var.c component. This can be exploited by a remote attacker to cause a denial of...

CVE-2018-2423

SAP Internet Graphics Server IGS, 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...