Mozilla Thunderbird Security Advisories (MFSA2018-05, MFSA2018-13) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

CVE-2018-5161

Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Thunderbird ESR 52.8 and Thunderbird 52.8...

Open Whisper Signal Cross-Site Scripting Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. A cross-site scripting vulnerability exists in Open Whisper Signal 1.10.1 and earlier versions, which stems from the program failing to filter HTML elements. A remote attacker can exploit the vulnerability by sendi...

Signal Desktop HTML Injection

Title: HTML tag injection in Signal-desktop Date Published: 14-05-2018 CVE Name: CVE-2018-10994 Class: Code injection Remotely Exploitable: Yes Locally Exploitable: No Vendors contacted: Signal.org Vulnerability Description: Signal-desktop is the standalone desktop version of the secure Signal...

CVE-2018-0253

A vulnerability in the ACS Report component of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is d...

ntp: Denial of Service via Malformed Config

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message...

IBM WebSphere MQ Denial of Service Vulnerability (CNVD-2018-08476)

IBM WebSphere MQ is a messaging middleware product from IBM, USA. The product focuses on providing a reliable and proven messaging backbone for Service Oriented Architecture SOA. A security vulnerability exists in IBM WebSphere MQ. An attacker could exploit this vulnerability with a specially...

SCTP Message Verification System Reboot

The vulnerability of the SCTP message verification mechanism in microprogramming software routers of Huawei AR3200, Huawei AR1200, and Huawei AR120-S arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to trigger a...

CVE-2018-1000098

Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2...

UBUNTU-CVE-2018-1000098

Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2...

CVE-2018-1000099

Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2...

Design/Logic Flaw

Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2...

CVE-2018-1000099

CVE-2018-1000099 affects Teluu PJSIP up to version 2.7.1, where a null/uninitialized pointer vulnerability in pjmedia SDP parsing can crash a system. Exploitation is tied to processing specially crafted SDP messages; the issue is stated to be fixed in PJSIP 2.7.2. Connected advisories reference D...

CVE-2018-1000099

Removed by vendor...

CVE-2018-1000098: Integer Overflow or Wraparound

Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2...

Teluu PJSIP Integer Overflow Vulnerability

Teluu PJSIP is an open source, free multimedia communication library written in C. pjmedia SDP is one of the SDP parsers. An integer overflow vulnerability exists in pjmedia SDP parsing in Teluu PJSIP 2.7.1 and earlier versions. An attacker can exploit this vulnerability by sending a specially...

CVE-2018-6866

Cross Site Scripting XSS exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message...

CVE-2018-6866

Cross Site Scripting XSS exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message...

CVE-2018-6866: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message...

CVE-2018-5378

An out-of-bounds read vulnerability was discovered in Quagga. A BGP peer could send a specially crafted message which would cause Quagga to read out of bounds, potentially causing a crash or disclosure of up to 64KB process memory to the peer...