Type confusion

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14278

CVE-2018-14278 affects Foxit Reader. The flaw is a type confusion in getPageNumWords that can allow remote code execution via crafted JavaScript when a user opens a malicious page/file. Exploitation requires user interaction. Reports/connected advisories indicate multiple related fixes; remediati...

CVE-2018-6058

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11215. Reason: This candidate is a reservation duplicate of CVE-2017-11215. Notes: All CVE users should reference CVE-2017-11215 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

KLA11204 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities possibly to cause denial of service or spoof user interface. Below is a complete list of vulnerabilities: 1. Incorrect processing of AppMenifests can be exploited remotely to perfo...

CVE-2017-6058

Buffer overflow in NetRxPkt::ehdrbuf in hw/net/netrxpkt.c in QEMU aka Quick Emulator, when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service out-of-bounds access and QEMU process crash via vectors related to VLAN stripping...

BELL-CVE-2017-6058 CVE-2017-6058 does not affect BellSoft software

Bulletin has no description...

CVE-2017-6058

CVE-2017-6058 affects QEMU with VLANSTRIP enabled on the vmxnet3 device. The vulnerability is a buffer overflow in NetRxPkt::ehdr_buf within hw/net/net_rx_pkt.c, which can lead to an out-of-bounds access and a denial of service (QEMU process crash) via VLAN-stripping related vectors. The descript...

Fedora 25 : 2:qemu (2017-31b976672b)

CVE-2016-7907: net: imx: infinite loop bz 1381182 - CVE-2017-5525: audio: memory leakage in ac97 bz 1414110 - CVE-2017-5526: audio: memory leakage in es1370 bz 1414210 - CVE-2016-10155 watchdog: memory leakage in i6300esb bz 1415200 - CVE-2017-5552: virtio-gpu-3d: memory leakage bz 1415283 -...

CVE-2015-6058

Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting XSS protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass."...

CVE-2015-6058

CVE-2015-6058 in Microsoft Edge describes a flaw where HTML attributes in HTTP responses are mishandled, allowing a remote attacker to bypass the Edge XSS filter. Affected product: Microsoft Edge. Root cause: improper handling of HTML attributes in HTTP response data, enabling a bypass of XSS pro...

CVE-2015-6058

Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting XSS protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass."...

Microsoft Edge XSS Filter Bypass (MS15-107: CVE-2015-6058)

An XSS filter bypass vulnerability exists in Microsoft Edge. A remote attacker could exploit this issue by convincing target users to view a web page containing malicious JavaScript code with an effected version of Microsoft Edge. Successful exploitation could allow an attacker to take any action...

KLA10674 Multiple vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper information...

Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_fixed_in_wireshark)

The remote Solaris system is missing necessary patches to address security updates : - Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files. CVE-2012-6052 - epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x befor...

appRain 3.0.2 - Blind SQL Injection Vulnerability

Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013 Vulnerability Type: SQL Injection...

SQL Injection in appRain

Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013 Vulnerability Type: SQL Injection...

CVE-2013-6058

CVE-2013-6058 affects appRain CMF 3.0.2 and earlier, exposing a SQL Injection via insufficient validation of user-supplied data appended to “/blog-by-cat/”. Remote attackers can execute arbitrary SQL commands (CWE-89); impact includes reading/modifying data. Exploitation details are described in ...

appRain 3.0.2 - Blind SQL Injection

appRain 3.0.2 - Blind SQL Injection Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013...

appRain 3.0.2 - Blind SQL Injection

Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013 Vulnerability Type: SQL Injection...

appRain 3.0.2 SQL Injection Vulnerability

appRain version 3.0.2 suffers from a remote SQL injection vulnerability. Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013...