Mozilla Firefox ESR < 68.7

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-13 advisory. - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and...

KLA11726 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Out of bounds write vulnerability in GMPDecodeData can be...

Security fix for the ALT Linux 10 package firefox-esr version 68.7.0-alt1

April 6, 2020 Andrey Cherepanov 68.7.0-alt1 - New ESR version 68.7.0. - Fixes: + CVE-2020-6828 Preference overwrite via crafted Intent from malicious Android application + CVE-2020-6827 Custom Tabs in Firefox for Android could have the URI spoofed + CVE-2020-6821 Uninitialized memory could be rea...

ICSA-19-295-01_Schneider Electric ProClima

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: Proclima Vulnerabilities: Code Injection, Improper Restriction of Operations within the Bounds of a Memory Buffer, Uncontrolled Search Path Element 2. RISK EVALUATION...

CVE-2019-6825

CVE-2019-6825 affects Schneider Electric ProClima prior to 8.0.0. It is an Uncontrolled Search Path Element (CWE-427) vulnerability that could allow a malicious DLL with the same name as a resident DLL to execute arbitrary code. The ICSA advisory confirms unauthenticated remote exploitation; CVSS...

Debian: Security Advisory (DLA-1611-2)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-6825

CVE-2018-6825 : Affected product is VOBOT CLOCK devices running versions prior to 0.99.30. The vulnerability arises from an SSH server that ships with a hardcoded root-level vobot user account/password, enabling full root access. This enables remote compromise with no user interaction. According ...

CVE-2016-6825

The CVE covers Huawei server families (XH620/V3, XH622/V3, XH628/V3 before specific SPC builds; RH1288V3 before SPC613; RH2288V3 before SPC617; RH2288H V3 before SPC515) where lack of authentication protection enables brute-force password retrieval via remote access. This reflects a remote-authen...

CVE-2016-6825

Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, and RH2288H V3 servers with software before V100R003C00SPC515 allow remote attackers to obtai...

CVE-2015-6825

FFmpeg vulnerability CVE-2015-6825 affects libavcodec/pthread_frame.c, where ff_frame_thread_init mishandles certain memory-allocation failures, enabling remote attackers to trigger a denial of service via a crafted AVI file (invalid pointer access). The issue is documented across multiple source...

CVE-2014-6825

The CVE applies to the Android application Teatro Franco Parenti (com.mintlab.mx.teatroparenti) version 1.4.0, where the app does not verify X.509 certificates when connecting to SSL servers. This allows man-in-the-middle attackers to spoof servers and exfiltrate sensitive information via a craft...

Fedora Update for mingw-pixman FEDORA-2014-6825

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-6825

1 movescu.cc and 2 storescp.cc in dcmnet/apps/, 3 dcmnet/libsrc/scp.cc, 4 dcmwlm/libsrc/wlmactmg.cc, 5 dcmprscp.cc and 6 dcmpsrcv.cc in dcmpstat/apps/, 7 dcmpstat/tests/msgserv.cc, and 8 dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call,...

CVE-2013-6825

CVE-2013-6825 affects DCMTK 3.6.1 and earlier, with multiple components (movescu, storescp, scp, wlmactmg, dcmprscp, dcmpsrcv, dcmpstat tests, and dcmqrscp) failing to check the return value of the setuid call. This permits local privilege escalation by spawning a large number of processes. Conne...

Trixbox langChoice PHP Local File Inclusion

$Id: $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ -- coding: utf-8 -- require 'msf/core' class...

Trixbox langChoice PHP Local File Inclusion

This module injects php into the trixbox session file and then, in a second call, evaluates that code by manipulating the langChoice parameter as described in OSVDB-50421. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

CVE-2008-6825

Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute arbitrary files via a .. dot dot in the langChoice parameter...

CVE-2008-6825

CVE-2008-6825 is a directory traversal/local file inclusion vulnerability in Fonality trixbox CE 2.6.1 and earlier, exposed via the langChoice parameter in user/index.php. The underlying issue is improper handling of the langChoice input, enabling an attacker to include and execute arbitrary file...

CVE-2008-6825

creationtimestamp| type| source ---|---|--- 2008-07-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6026 2008-07-12 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6045 2011-01-08 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/16904 2018-05-29...

CVE-2006-6825

CVE-2006-6825 affects Calendar MX BASIC 1.0.2 and earlier. The vulnerability arises because the application stores sensitive information under the web root with insufficient access control, enabling remote attackers to download the database (calendar.mdb) via a direct request. The records indicat...