CVE-2017-14635

In Open Ticket Request System OTRS 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection...

Code injection

In Open Ticket Request System OTRS 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection...

ffmpeg: Global-buffer-overflow in initSlotBasedRotation

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=4898065225875456 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDLIBFDKAACfuzzer Fuzz target binary: ffmpegAVCODECIDLIBFDKAACfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

CVE-2017-14684

In ImageMagick 7.0.7-4 Q16, a memory leak vulnerability was found in the function ReadVIPSImage in coders/vips.c, which allows attackers to cause a denial of service memory consumption in ResizeMagickMemory in MagickCore/memory.c via a crafted file...

Out-of-bounds

In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash...

Apple Releases Security Updates

Apple has released security updates to address vulnerabilities in multiple products. A remote attacker may exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the following Apple security pages and apply the necessary...

About the security content of watchOS 4

About the security content of watchOS 4 This document describes the security content of watchOS 4. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Tcpdump IEEE 802.15.4 Parser Buffer Overflow Vulnerability

Tcpdump is a set of sniffing tools developed by the Tcpdump team that run under the command line. This tool allows users to intercept and display TCP/IP and other packets sent or received over a network connection to that computer.IEEE 802.15.4 parser is one of the IEEE 802.15.4 standard parsers....

Adobe ColdFusion APSB17-30 Remote Command Execution Vulnerability (CNVD-2017-30530)

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. A security vulnerability exists in Adobe ColdFusion 2016 release Update 4 and earlier and ColdFusion 11 Upda...

Regular Expression Denial of Service

Overview Affected versions of parsejson are vulnerable to a regular expression denial of service when parsing untrusted user input. Recommendation The parsejson package has not been functionally updated since it was initially released. Additionally, it provides functionality which is natively...

RHEL 7 : qemu-kvm-rhev (RHSA-2017:2628)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2628 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the...

CVE-2015-3169

Cross-site scripting XSS vulnerability in askbot 0.7.51-4.el6.noarch...

Threat Outbreak Alert RuleID30449: Email Messages Distributing Malicious Software on September 4, 2017

Medium Alert ID: 55101 First Published: 2017 September 5 15:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30449 may contain the following files: Name |...

nooresunnat.com XSS vulnerability

Vulnerable URL: http://www.nooresunnat.com/Search.php?selectBayanType=21=14=Lahab%22%3E%3Csvg/onload=prompt/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 03.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 271130 VIP...

gdal: Heap-buffer-overflow in rdieee

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6389879183245312 Project: gdal Fuzzer: libFuzzergdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x60300000ce60 Crash State: rdieee...

CVE-2017-14054

In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivrreadheader due to lack of an EOF End of File check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would...

Android Studio 1-4 & 2.3.3 - Buffer Overflow Vulnerability

Document Title: =============== Android Studio 1-4 & 2.3.3 - Buffer Overflow Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2092 Video: https://www.youtube.com/watch?v=cdXChK64WLc Release Date: ============= 2017-08-30 Vulnerability Laboratory ID VL-ID:...

thaitsuki.com XSS vulnerability

Vulnerable URL: http://www.thaitsuki.com/item.php?ItemID=4...

HP Integrated Lights-Out (iLO) 4 Multiple Remote Vulnerabilities

HP Integrated Lights-Out iLO 4 is prone to multiple remote vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation

This module exploits an authentication bypass in HP iLO 4 1.00 to 2.50, triggered by a buffer overflow in the Connection HTTP header handling by the web server. Exploiting this vulnerability gives full access to the REST API, allowing arbitrary accounts creation. Module Options msf use...