376 matches found
Design/Logic Flaw
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user vi...
Pulverizr Injection Vulnerability
pulverizr is an image compressor. A security vulnerability exists in pulverizr 0.7.0 and earlier versions, which stems from a failure to perform any cleanup on the 'filename' parameter, which is directly used by the function. The vulnerability can be exploited to execute arbitrary commands...
Command injection
pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...
CVE-2020-7604
pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...
Apache Ranger Cross-Site Request Forgery Vulnerability
Apache Ranger is a set of architectures from the Apache USA Software Foundation that implement comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...
PT-2018-15375 · Telegram · Telegram
Name of the Vulnerable Software and Affected Versions: Telegram version 4.9.1 Telegram Web-version 0.7.0 Description: The issue concerns a side channel in the "secret chat" feature where Telegram servers send GET requests for URLs typed while composing a chat message, before the message is sent...
PNGwriter Denial of Service Vulnerability
PNGwriter is a C++ library for creating PNG images. A security vulnerability exists in the 'pngwriter::readfromfile' function in the pngwriter.cc file in PNGwriter version 0.7.0. An attacker can exploit this vulnerability to cause a denial of service segmentation error...
CVE-2018-14047
An issue has been found in PNGwriter 0.7.0. It is a SEGV in pngwriter::readfromfile in pngwriter.cc. NOTE: there is a "Warning: PNGwriter was never designed for reading untrusted files with it. Do NOT use this in sensitive environments, especially DO NOT read PNGs from unknown sources with it!"...
Design/Logic Flaw
DISPUTED An issue has been found in PNGwriter 0.7.0. It is a SEGV in pngwriter::readfromfile in pngwriter.cc. NOTE: there is a "Warning: PNGwriter was never designed for reading untrusted files with it. Do NOT use this in sensitive environments, especially DO NOT read PNGs from unknown sources wi...
PT-2018-12301 · Pngwriter · Pngwriter
Name of the Vulnerable Software and Affected Versions: PNGwriter version 0.7.0 Description: The issue is related to a SEGV in pngwriter::readfromfile in pngwriter.cc. It is noted that PNGwriter was never designed for reading untrusted files, and users are warned not to use it in sensitive...
Unspecified vulnerability in Http-proxy
Http-proxy is a full-featured HTTP proxy for Node.js. A security vulnerability exists in Http-proxy versions prior to 0.7.0. An attacker can exploit this vulnerability to cause a denial of service server crash...
GitList 0.6 - Unauthenticated Remote Code Execution Exploit
Exploit for php platform in category web applications ''' Exploit Title: GitList 0.6 Unauthenticated RCE Software Link: https://github.com/klaussilveira/gitlist Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: remote 1...
GitList 0.6 - Remote Code Execution
''' Exploit Title: GitList 0.6 Unauthenticated RCE Date: 25-04-2018 Software Link: https://github.com/klaussilveira/gitlist Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: remote 1. Description Bypass/Exploit escapeshellarg...
Apache Atlas Cross-Site Scripting Vulnerability (CNVD-2017-27444)
Apache Atlas is a set of scalable and extensible core functional governance services from the Apache USA Software Foundation. A cross-site scripting vulnerability exists in the search function in Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating. A remote attacker can exploit this...
Apache Atlas Cross-Site Scripting Vulnerability (CNVD-2017-27442)
Apache Atlas is a set of scalable and extensible core functional governance services from the Apache USA Software Foundation. A cross-site scripting vulnerability exists in the edit-tag feature in Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating. A remote attacker can exploit this...
Apache Atlas Cross-Site Scripting Vulnerability
Apache Atlas is a set of scalable and extensible core functional governance services from the Apache USA Software Foundation. A cross-site scripting vulnerability exists in Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating. A remote attacker can exploit this vulnerability to inject...
Apache Atlas Cross-Site Scripting Vulnerability (CNVD-2017-27443)
Apache Atlas is a set of scalable and extensible core functional governance services from the Apache USA Software Foundation. A cross-site scripting vulnerability exists in the edit-tag feature in Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating. A remote attacker can exploit this...
PYSEC-2017-107
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality...