9714 matches found
Bento4 Buffer Overflow Vulnerability (CNVD-2019-28469)
Bento4 is an open source C++ library for reading and writing MP4 files. A buffer overflow vulnerability exists in the AP4AvccAtom class of the Core/Ap4AvccAtom.cpp file in Bento4 version 1.5.1.0, which can be exploited by an attacker to cause a buffer overflow or heap overflow...
CVE-2019-13578: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php...
PT-2019-13436 · Impress · Give
Name of the Vulnerable Software and Affected Versions: Impress GiveWP Give plugin versions prior to 2.5.1 Description: A SQL injection issue exists, allowing a remote attacker to execute arbitrary SQL commands on the affected system via the includes/payments/class-payments-query.php file...
CVE-2019-15050
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4AvccAtom class at Core/Ap4AvccAtom.cpp...
CVE-2019-15049
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4Dec3Atom class at Core/Ap4Dec3Atom.cpp...
Epic Games Hit With Class Action Lawsuit Over Hacked 'Fortnite' Accounts
Epic Games, the creator of the popular 'Fortnite' video game, is facing a class-action lawsuit from gamers over hacked Fortnite accounts, accusing the company of failing to maintain adequate security measures and notify users of the security breach in a timely manner. The lawsuit, filed by...
SEC Investigating Data Leak at First American Financial Corp.
The U.S. Securities and Exchange Commission SEC is investigating a security failure on the Web site of real estate title insurance giant First American Financial Corp. that exposed more than 885 million personal and financial records tied to mortgage deals going back to 2003, KrebsOnSecurity has...
KDE KDesktopFile Command Injection
A command injection vulnerability exists in KDesktopFile class. A remote attacker could exploit this vulnerability by sending a crafted compressed folder to an affected client...
The ViewLogging class exposed various resources that were vulnerable to CSRF - CVE-2019-11587
Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery CSRF...
Denial Of Service (DoS)
exempi is vulnerable to denial of service DoS. The vulnerability exists through an infinite Loop in Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp...
exempi: Infinite Loop in Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp
An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service infinite loop via crafted XMP data in a .avi file...
ruby: Unintentional directory traversal by poisoned NULL byte in Dir
It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script...
GHSA-25PC-85QF-6J69 Deserialization of Untrusted Data in Apache Storm
In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...
Deserialization of Untrusted Data in Apache Storm
In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...
CVE-2015-7559
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client...
PT-2019-5099
Name of the Vulnerable Software and Affected Versions Django versions 1.11.x through 1.11.22 Django versions 2.1.x through 2.1.10 Django versions 2.2.x through 2.2.3 Description The issue is related to the django.utils.text.Truncator class, specifically the chars and words methods. When these...
CVE-2015-7559
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client...
CVE-2019-1020012
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
