PT-2018-16141 · Node.Js · Connect

Name of the Vulnerable Software and Affected Versions: connect node module versions prior to 2.14.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability due to a lack of validation of a file in the directory.js middleware. This allows for potential exploitation. No...

Updated TiMidity++ packages fix security vulnerabilities

The insertnotesteps function in readmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted mid file. NOTE: a crash might be relevant when using the --background option CVE-2017-11546. The resamplegauss function in...

CVE-2017-11546

The insertnotesteps function in readmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted mid file. NOTE: a crash might be relevant when using the --background option...

CVE-2017-11547

The resamplegauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted mid file. NOTE: a crash might be relevant when using the --background option. NOTE: the TiMidity++ README.alsaseq documentation suggests a...

CVE-2017-11549

The playmidi function in playmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service large loop and CPU consumption via a crafted mid file. NOTE: CPU consumption might be relevant when using the --background option...

Design/Logic Flaw

The playmidi function in playmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service large loop and CPU consumption via a crafted mid file. NOTE: CPU consumption might be relevant when using the --background option...

CVE-2017-11547

The resamplegauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted mid file. NOTE: a crash might be relevant when using the --background option. NOTE: the TiMidity++ README.alsaseq documentation suggests a...

CVE-2017-11547

The resamplegauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted mid file. NOTE: a crash might be relevant when using the --background option. NOTE: the TiMidity++ README.alsaseq documentation suggests a...

Piwik Superuser Plugin Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' class MetasploitModule 'Piwik Superuser Plugin Upload', 'Description' = %q This module will generate a plugin, pack the payload...

CVE-2006-6698

The GConf daemon gconfd in GConf 2.14.0 creates temporary files under directories with names based on the username, even when GCONFGLOBALLOCKS is not set, which allows local users to cause a denial of service by creating the directories ahead of time, which prevents other users from using Gnome...

CVE-2014-7201

Multiple SQL injection vulnerabilities in the search function in pi1/class.txdmmjobcontrolpi1.php in the JobControl dmmjobcontrol extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the 1 education, 2 region, or 3 sector fields, as demonstrated by t...

CVE-2008-3931

javareconf in R 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files...

CVE-2006-6698

The GConf daemon gconfd in GConf 2.14.0 creates temporary files under directories with names based on the username, even when GCONFGLOBALLOCKS is not set, which allows local users to cause a denial of service by creating the directories ahead of time, which prevents other users from using Gnome...

CVE-2006-6698

The CVE-2006-6698 issue affects the GConf daemon (gconfd) in GConf 2.14.0. It creates temporary files in directories named after the user, even when GCONF_GLOBAL_LOCKS is not set. This enables a local attacker to pre-create the directories and cause a denial of service that blocks other users fro...

CVE-2005-3519

Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the 1 INCLUDEPATH and 2 SQUIZLIBPATH parameters in newupgradefunctions.php, 3 the INCLUDEPATH parameter in initmysource.php, and the PEARPATH...

CVE-2005-3520

Multiple cross-site scripting XSS vulnerabilities in MySource 2.14.0 allow remote attackers to inject arbitrary web script or HTML via 1 the targeturl parameter in upgradeinprogressbackend.php, 2 the stylesheet parameter in edittablecelltypewysiwyg.php, and the bgcolor parameter in 3...