2551 matches found
UBUNTU-CVE-2019-18888
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command...
CVE-2019-18888
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command...
CVE-2019-18888
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command...
gitea -- multiple vulnerabilities
The Gitea Team reports: This release contains five security fixes, so we recommend updating: Fix issue with user.fullname Ignore mentions for users with no access Be more strict with git arguments Extract the username and password from the mirror url Reserve .well-known username...
ntfs-3g: heap-based buffer overflow leads to local root privilege escalation
An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In...
JavaScriptCore - Type Confusion During Bailout when Reconstructing Arguments Objects Exploit
The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds: function main const v2 = 1337,1337; const v3 = 1337,v2,v2,0; Object.proto = v3; for let v10 = 0; v10 inheritscell-JSC::JSCell::vm, std::removepointer::type::info ../../So...
Libosinfo: osinfo-install-script option leaks password via command line argument
A flaw was found in libosinfo, version 1.5.0, where the script for automated guest installations, 'osinfo-install-script', accepts user and admin passwords via command line arguments. This could allow guest passwords to leak to other system users via a process listing...
JavaScriptCore - Type Confusion During Bailout when Reconstructing Arguments Objects
JavaScriptCore - Type Confusion During Bailout when Reconstructing Arguments Objects The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds: function main const v2 = 1337,1337; const v3 = 1337,v2,v2,0; Object.proto = v3; for let v10 = 0; v10...
JavaScriptCore - Type Confusion During Bailout when Reconstructing Arguments Objects
The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds: function main const v2 = 1337,1337; const v3 = 1337,v2,v2,0; Object.proto = v3; for let v10 = 0; v10 inheritscell-JSC::JSCell::vm, std::removepointer::type::info ../../So...
JSC Argument Object Reconstruction Type Confusion
JSC: Type confusion during bailout when reconstructing arguments objects The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds: function main const v2 = 1337,1337; const v3 = 1337,v2,v2,0; Object.proto = v3; for let v10 = 0; v10...
The vulnerability of the docker build mechanism, a tool for automating the deployment and management of applications in containerized environments, allows an attacker to gain unauthorized access to information, cause service failures, or affect the availability of information.
The vulnerability of the docker build mechanism, a tool for automating the deployment and management of applications in containerized environments, is related to insufficient testing of arguments passed in commands. Exploiting this vulnerability can allow attackers to gain unauthorized access to...
Deserialization of untrusted data
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the doaction function to invoke certain popmake or pum methods, as demonstrated by controlling content and delivery of popmake-system-info.txt aka the...
Popup-Maker < 1.8.12 - Multiple Vulnerabilities
An attacker can partially control the arguments of the doaction, during the initialization of the PUMSite . Because of this, an attacker can call any method which contains an action starting from popmake or pum . This will lead to successful execution of functions which do not require arguments...
CVE-2019-17499
The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the TargetIP parameter...
EulerOS 2.0 SP3 : libosinfo (EulerOS-SA-2019-2003)
According to the version of the libosinfo package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in libosinfo, version 1.5.0, where the script for automated guest installations, 'osinfo-install-script', accepts user and admin...
EulerOS Virtualization for ARM 64 3.0.2.0 : libosinfo (EulerOS-SA-2019-1952)
According to the version of the libosinfo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A flaw was found in libosinfo, version 1.5.0, where the script for automated guest installations,...
Mozilla Firefox and Mozilla Firefox ESR Arbitrary Code Execution Vulnerability
Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security vulnerability exists in Mozilla Firefox versions prior to Mozilla...
The vulnerability of the ePolicy Orchestrator extension of the McAfee Data Loss Prevention Endpoint software allows a perpetrator to execute arbitrary code.
The vulnerability of the ePolicy Orchestrator extension of the McAfee Data Loss Prevention Endpoint software relates to insufficient validation of arguments passed to the command. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform
https://github.com/WebKit/webkit/blob/94e868c940d46c5745869192d07255331d00102b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cppL743 case GetByVal: ... unsigned numberOfArgumentsToSkip = 0; if candidate-op == PhantomCreateRest numberOfArgumentsToSkip = candidate-numberOfArgumentsToSkip;...