Low: Red Hat Security Advisory: zziplib security update

An update for zziplib is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2019-6541

CVE-2019-6541 affects Wecon LeviStudioU (fontlib) with memory corruption in FontLib.dll, leading to arbitrary code execution. The vulnerability exists in LeviStudioU prior to version 1.8.69 and can be triggered by processing crafted input; ZDI notes memory corruption in FontLib.dll allowing remot...

WECON LeviStudioU (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: WECON Technology Co., Ltd WECON Equipment: LeviStudioU Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Memory Corruption 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

Fedora 28 : zziplib (2018-237e9b550c)

Update zziplib to 0.13.69 version, fixes all known CVEs for the package. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora Update for zziplib FEDORA-2018-45183aab17

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

jhp2.com XSS vulnerability

Open Bug Bounty ID: OBB-654401 Description| Value ---|--- Affected Website:| jhp2.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Code injection

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-653...

Code injection

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-654...

CVE-2016-6538

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-654...

Code injection

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps,...

CVE-2016-6541

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-653...

CVE-2016-6541

The CVE-2016-6541 entry concerns TrackR Bravo. The affected software is the TrackR Bravo mobile app (iOS v5.1.6, Android v2.2.5). The vulnerability arises from unauthenticated pairing, enabling unauthenticated connected applications to write to various device attributes. The connected documents c...

CVE-2016-6538 TrackR Bravo mobile application stores account passwords in cleartext

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-654...

Ubuntu: Security Advisory (USN-3699-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-6541

CVE-2018-6541 : In ZZIPlib 0.13.67, a bus error caused by loading a misaligned address in __zzip_fetch_disk_trailer (zzip/zip.c) can be triggered by a crafted zip file, enabling a remote DoS. Connected advisories confirm fixes across multiple distros (e.g., Debian, Fedora, CentOS, Amazon Linux 2)...

CVE-2018-6541

In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address when handling disk64trailer local entries in zzipfetchdisktrailer zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file...

CVE-2018-6541

In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address when handling disk64trailer local entries in zzipfetchdisktrailer zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file...

CVE-2013-6541

...

CVE-2013-6541

CVE-2013-6541 is rejected/not used; this candidate does not represent an active vulnerability entry.

CVE-2017-6541

Multiple Cross-Site Scripting XSS issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data benchmark, time passed to the webpagetest-master/www/benchmarks/viewtest.php URL. An attacker could execute arbitrary HTML and script code in...