Arbitrary Code Injection

libpcap.so is vulnerable to code injection vulnerability. The attack is possible because it reuses a variable, causing an incorrect handling to check length values and allowing an attacker to inject extra data at the end of a request...

CVE-2018-6142

CVE-2018-6142 describes an out-of-bounds read vulnerability in Google Chrome’s V8 engine (pre-67.0.3396.62) that can be triggered by a crafted PDF file, allowing remote memory access. Connected advisories (Debian DSA-4237-1) indicate a fix in Chromium-based packages and note updates to version 67...

CVE-2019-6556

When processing project files, the application Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the...

CVE-2019-0604

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594...

Notepad++: Security check failure or stack buffer overrun (crash)

poc.py 1 Run poc.py 2 Open notepad++.exe 3 Go to "Define language..." 4 Use tab "Comment and Number" 5 Open 1stfield.txt and copy content to clipboard 6 Paste clipboard on "Comment line style in field Open" 7 Open 2ndfield.txt and copy content to clipboard 8 Paste clipboard on "Comment line style...

CVE-2018-4207

In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks...

DENX U-Boot Buffer Overflow Vulnerability (CNVD-2019-00332)

DENX Software Engineering Das U-Boot is a set of bootloaders from DENX Software Engineering, Germany, that can read device configurations from AES encrypted files. A buffer overflow vulnerability exists in the network image boot in DENX Software Engineering Das U-Boot, which stems from the progra...

ImageMagick Denial of Service Vulnerability (CNVD-2019-12132)

ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A denial of service vulnerability exists in ImageMagick versions 7.0.7-29 and earlier, which stems from a failure to perform a NULL check in ReadOneJNGImage in...

CloudBees Jenkins Unauthorized Operation Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...

Null pointer dereference

In FFmpeg 4.0.1, a missing check for failure of a call to initgetbits8 in the avprivac3parseheader function in libavcodec/ac3parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service...

Google Android System Information Disclosure Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in the sdpserver.cc file in Android in the sdpserverhandleclientreq file, which stems from a lack of boundary detection in the...

ARM mbed TLS integer overflow vulnerability

ARM mbed TLS is a product that provides secure communication and encryption capabilities for mbed products. An integer overflow vulnerability exists in ARM mbed TLS. Due to a failure in the sslparseclientpskidentity function, the affected software fails to properly perform boundary checks. An...

Arbitrary File Upload Vulnerability in Monxin v4.0

Monxin mall system is a mall management system based on PC mall + mobile mall + WeChat mall + offline cashier, members / orders / commodities / inventory online and offline real-time synchronization of data across the network. Monxin v4.0 suffers from an arbitrary file upload vulnerability, which...

EPA for device certificate check fails on NetScaler

Users get the error "access denied" after EPA scan even with valid certificates available in the store...

Google Android NVIDIA component elevation of privilege vulnerability (CNVD-2017-36939)

Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance OHA, and NVIDIA mediaserver is a multimedia server component used in it. An elevation of privilege vulnerability exists in NVIDIA mediaserver in Android, which stems from a failure to properly...

Huawei VIE-L09 Buffer Overflow Vulnerability (CNVD-2017-34412)

Huawei VIE-L09 is a smartphone from Huawei Huawei. The Huawei VIE-L09 suffers from a buffer overflow vulnerability that occurs when the device fails to adequately check parameters. An attacker exploits the vulnerability by tricking the user into installing a malicious application that sends...

Apache Portable Runtime Denial of Service Vulnerability

Apache Portable Runtime Utility APR-util is an Apache Apache Software Foundation utility that provides an underlying support interface for upper-tier applications that can be used across multiple operating system platforms. A security vulnerability exists in Apache Portable Runtime Utility APR-ut...

CVE-2017-9505

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments add...

WebKit JSC - JSObject::ensureLength ensureLengthSlow Check Failure

WebKit JSC - JSObject::ensureLength ensureLengthSlow Check Failure / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1165 Here's a snippet of JSObject::ensureLength. bool WARNUNUSEDRETURN ensureLengthVM& vm, unsigned length ASSERTlength vectorLength publicLength...

WebKit JSC - 'JSObject::ensureLength' ensureLengthSlow Check Failure

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1165 Here's a snippet of JSObject::ensureLength. bool WARNUNUSEDRETURN ensureLengthVM& vm, unsigned length ASSERTlength vectorLength publicLength setPublicLengthlength; return result; |setPublicLength| is called whether...