[SECURITY] Fedora 28 Update: uriparser-0.9.0-1.fc28

Uriparser is a strictly RFC 3986 compliant URI parsing library written in C. uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license...

SUSE SLES11 Security Update : Recommended update for php53 (SUSE-SU-2018:3986-1)

This update for php53 fixes the following issues : Security issue fixed : CVE-2018-19518: Fixed imapopen script injection flaw bsc1117107. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

[SECURITY] Fedora 27 Update: nodejs-uri-js-4.2.2-2.fc27

URI.js is an RFC 3986 compliant, scheme extendable URI parsing/validating/resolving library for all JavaScript environments browsers, Node.js, etc...

[SECURITY] Fedora 28 Update: nodejs-uri-js-4.2.2-2.fc28

URI.js is an RFC 3986 compliant, scheme extendable URI parsing/validating/resolving library for all JavaScript environments browsers, Node.js, etc...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

CVE-2013-3986

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/misc/ibmsametimewebplayerdos.rb 2025-02-06 03:13:41+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:09:19+00:00| seen|...

Ruby: Invalid URL parsing '#'

URI is not correctly parsed when "" is included in the URL. Therefore, could instead be tricked into connecting to a different host. PoC bash $ ruby --version ruby 2.4.1p111 2017-03-22 revision 58053 x8664-darwin16 ruby require 'uri' uri = URI"http://[email protected]/test" = p...

CVE-2017-3986

This CVE ID is rejected/not used; the entry does not represent an active vulnerability.

CVE-2017-3986

...

3986.net XSS vulnerability

Open Bug Bounty ID: OBB-441020 Description| Value ---|--- Affected Website:| 3986.net Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Debian DSA-3986-1 : ghostscript - security update

Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service if a specially crafted Postscript file is processed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian: Security Advisory (DSA-3986-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-3986

CVE-2016-3986 affects Avast Antivirus and is triggered by a crafted PE file, exploiting the authenticode parsing path to cause memory corruption and potentially execute arbitrary code. The vulnerability’s impact is a denial-of-service with memory corruption (and possible code execution). Affected...

CVE-2016-3986

Avast allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing...

CVE-2016-3986

creationtimestamp| type| source ---|---|--- 2016-03-07 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/39530...

CVE-2015-3986

Cross-site request forgery CSRF vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attack...

CVE-2015-3986

TheCartPress eCommerce Shopping Cart (WordPress plugin) is affected by CVE-2015-3986: CSRF allows remote attackers to hijack administrator sessions via directory traversal through tcp_box_path on the checkout_editor_settings page leading to wp-admin/admin.php. Affected versions: WordPress plugin ...

[oss-security] Re: CVE request: PHP configure script and Lynis tool /tmp/ issues reported on full disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 39 if "$OS" = "AIX" ; then 40 TMPFILE=/tmp/lynis.$$ We can make a CVE assignment corresponding to your disclosure of this lynis.$$ issue on oss-security. Use CVE-2014-3982. A CVE for this most likely won't or shouldn't have a...

CVE-2014-3986

include/testswebservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis..unsorted file with an easily determined name...

CVE-2014-3986

The CVE-2014-3986 entry concerns Lynis (before 1.5.5) where a symlink attack on a temporary file (/tmp/lynis.*.unsorted) can allow local users to overwrite arbitrary files. The underlying issue is a path/temporary-file handling weakness that enables a symlink to point to a target file, enabling m...