1366 matches found
Input validation
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation...
CVE-2018-5733
A malicious client which is allowed to send very large amounts of traffic billions of packets to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 - 4.1-ESV-R15, 4.2.0 - 4.2.8, 4.3.0 - 4.3.6, 4.4.0...
Design/Logic Flaw
A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond...
Design/Logic Flaw
A malicious client which is allowed to send very large amounts of traffic billions of packets to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 - 4.1-ESV-R15, 4.2.0 - 4.2.8, 4.3.0 - 4.3.6, 4.4.0...
Denial Of Service (DoS)
dhcp is vulnerable to denial of service DoS attacks. The vulnerability exists as ISC DHCP 4.1.2 through 4.2.4 and 4.1-ESV before 4.1-ESV-R6 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a malformed client identifier...
PT-2019-4614 · FFmpeg +3 · Ffmpeg +3
Name of the Vulnerable Software and Affected Versions: FFmpeg versions 3.2 through 4.1 Description: The issue is related to a denial of service in the subtitle decoder, allowing attackers to consume excessive CPU resources via a crafted video file in Matroska format. This is due to the ff...
CVE-2018-1000881
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web application request by a...
CVE-2018-19790
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the failurepath input field of login forms, an attacker can work around the redirection target restrictio...
Grammarly: Grammarly Keyboard for Android <4.1 leaks user input through logs (except for sensitive input fields)
@homelander identified that Grammarly for Android on Android 4.1 was leaking user-entered text to device logs. Currently, Grammarly for Android doesn't support devices with platform versions less than Android 5.0...
Design/Logic Flaw
SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...
MGASA-2018-0440 Updated iniparser packages fix security vulnerability
A flaw was found in iniparser version prior to 4.1. A stack buffer underflow in the function iniparserload in iniparser.c file which can be triggered by parsing a file that containing a zero-byte. This vulnerability may allow an attacker to cause a Denial of Service DoS...
WordPress 4.1.x < 4.1.23 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Localhost is treated as same host by default. - Unsafe redirects are used when redirecting the login page if SSL is forced. - The version string is not correctly escaped f...
WordPress 4.1.x < 4.1.14 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...
Security Bulletin: Vulnerability in WebSphere Liberty ORB client
Summary There's a vulnerability in WebSphere Liberty ORB client used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1683 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, cause...
GHSA-45VG-2V73-VM62 Moderate severity vulnerability that affects org.springframework:spring-core
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...
Alchemy CMS 4.1-Stable Cross Site Scripting
Exploit Title: AlchemyCMS 4.1-stable - Cross-Site Scripting Date: 2018-10-14 Exploit Author: Ismail Tasdelen Vendor Homepage: https://alchemy-cms.com/ Software Link : https://github.com/AlchemyCMS/alchemycms Software : AlchemyCMS Version : 4.1-stable Vulernability Type : Cross-site Scripting...
SAP BusinessObjects BI Platform Servers Information Disclosure Vulnerability
SAP BusinessObjects Business Intelligence BI Platform Servers is a suite of business intelligence software and enterprise performance solutions from SAP. The product has a report generation, analysis, data visualization, etc. Software Development Kit SDK is one of the software development kit. An...
CVE-2018-17126
CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...