CVE-2018-17341

BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtreehtaccessurl=admin/images/..\ URI...

DEBIAN-CVE-2018-13259

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one...

CVE-2018-13259

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one...

UBUNTU-CVE-2018-13259

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one...

pcre: stack-based buffer overflow write in pcre32_copy_substring

Stack-based buffer overflow in the pcre32copysubstring function in pcreget.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service WRITE of size 4 or possibly have unspecified other impact via a crafted file...

pcre: stack-based buffer overflow write in pcre32_copy_substring

Stack-based buffer overflow in the pcre32copysubstring function in pcreget.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service WRITE of size 268 or possibly have unspecified other impact via a crafted file...

PT-2018-12495 · Mp4V2 · Mp4V2

Name of the Vulnerable Software and Affected Versions: MP4v2 version 2.0.0 Description: The issue arises from the MP4NameFirstMatches function in mp4util.cpp, which incorrectly handles substrings of atom names. This mishandling leads to the use of an inappropriate data type for associated atoms,...

Sql injection

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2018-12039

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

UBUNTU-CVE-2017-18264

An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg'Servers'$i'AllowNoPassword' = false are bypassed under certain PHP versions e.g., version 5. This can allow the login of users who have no...

Design/Logic Flaw

CMS Made Simple CMSMS through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring...

CVE-2018-10081

CMS Made Simple CMSMS through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring...

CVE-2018-7467

AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI...

Directory traversal

AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI...

CVE-2018-7467: Improper Limitation of a Pathname to a Restricted Directory

AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI...

Design/Logic Flaw

node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID...

CVE-2015-2298

node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID...

CVE-2015-2298

node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID...

CVE-2015-2298

The vulnerability CVE-2015-2298 affects Etherpad Lite 1.5.x prior to 1.5.2, specifically in node/utils/ExportEtherpad.js. A flawed substring check when exporting a padID can allow a remote attacker to obtain sensitive information from the pad. This is a client-tolerated information disclosure ris...

CVE-2015-2298: Exposure of Sensitive Information to an Unauthorized Actor

node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID...