PT-2018-14972

Name of the Vulnerable Software and Affected Versions Gnuplot version 5.2.5 Description An issue in datafile.c allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in df generate ascii array entry. This can be exploited by passing an overlong string as the...

generate-password.com XSS vulnerability

Open Bug Bounty ID: OBB-692129 Description| Value ---|--- Affected Website:| generate-password.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

GHSA-Q7PF-QR96-2VQ5 Deserialization of Untrusted Data in swagger-parser

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

One-Lin3r v1.1 - Gives You One-Liners That Aids In Penetration Testing Operations

One-Lin3r is simple and light-weight framework inspired by the web-delivery module in Metasploit. It consists of various one-liners that aids in penetration testing operations: Reverser : Give it IP & port and it returns a reverse shell liner ready for copy & paste. Dropper : Give it an...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15883)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Generate Diagnostics" method in Quest DR Series disk backup software versions prior to 4.0.3.1. The vulnerability can be exploited to execute arbitrary system commands via a special...

PT-2018-4537

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level Description A buffer overread issue occurs in the playready leavedomain generate challenge function when the cchFriendlyName is greater than TZ PR MAX NAME LEN. This issue affects Andro...

UBUNTU-CVE-2018-7998

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vipsregiongenerate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race conditi...

PT-2018-18368 · Libvips +3 · Libvips +3

Name of the Vulnerable Software and Affected Versions: libvips versions prior to 8.6.3 Description: A NULL function pointer dereference issue was found in the vips region generate function, which can be exploited by remote attackers using a crafted image file. This issue arises due to a race...

CVE-2017-18032

The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdmgeneratepassword action to wp-admin/admin-ajax.php...

PT-2018-6624

Name of the Vulnerable Software and Affected Versions: WordPress download-manager plugin versions prior to 2.9.52 Description: The issue concerns a security problem where an attacker can exploit the id parameter in a wpdm generate password action to wp-admin/admin-ajax.php API endpoint, leading t...

ruby: Arbitrary heap exposure during a JSON.generate call

A buffer overflow vulnerability was found in the JSON extension of ruby. An attacker with the ability to pass a specially crafted JSON input to the extension could use this flaw to expose the interpreter's heap memory...

CVE-2017-1000207

A vulnerability in Swagger-Parser's version = 1.0.30 and Swagger codegen version = 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in...

PT-2017-10905

Name of the Vulnerable Software and Affected Versions Swagger-Parser versions = 1.0.30 Swagger codegen versions = 2.2.2 Description A vulnerability in Swagger-Parser's yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is...

CVE-2017-1000207: Deserialization of Untrusted Data

A vulnerability in Swagger-Parser's version = 1.0.30 and Swagger codegen version = 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in...

OPENVAS SCAN / Greenbone Enterprise Appliance (GEA) / Greenbone Security Manager (GSM) / Greenbone OS (GOS) Detection (HTTP)

HTTP based detection of OPENVAS SCAN / Greenbone Enterprise Appliance GEA / Greenbone Security Manager GSM / Greenbone OS GOS. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2017-1000208

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

CVE-2017-1000208: Deserialization of Untrusted Data

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

PT-2017-10906

Name of the Vulnerable Software and Affected Versions Swagger-Parser versions = 1.0.30 swagger-codegen versions = 2.2.2 Description A vulnerability in Swagger-Parser's yaml parsing functionality can result in arbitrary code execution when a maliciously crafted yaml Open-API specification is parse...

Medium: ruby24

Issue Overview: Arbitrary heap exposure during a JSON.generate call Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a...

Amazon Linux AMI : ruby22 / ruby23 (ALAS-2017-906)

SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP A SMTP command injection flaw was found in the way Ruby's Net::SMTP module handled CRLF sequences in certain SMTP commands. An attacker could potentially use this flaw to inject SMTP commands in a SMTP session...