WebKit - WebCore::InputType::element Use-After-Free (2)

WebKit - WebCore::InputType::element Use-After-Free 2 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1345 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

UBUNTU-CVE-2017-7842

If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "" elements instead of one. One of these requests includes the referrer instead of respecting the set policy to not include a referrer on requests. This vulnerability affects Firefox 57...

CVE-2017-12781

The EBMLBufferToID function in ebmlelement.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service Null pointer dereference and application crash via a crafted mkv file...

libebml2 EBML_FindNextElement Function Denial of Service Vulnerability

libebml2 is a mkv file parsing library for analyzing or parsing mkv files for playback. A denial of service vulnerability exists in the EBMLFindNextElement function in libebml2 2012-08-26 and earlier ebmlmain.c. The vulnerability can be exploited to cause a denial of service null pointer...

CVE-2017-14029

An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files placed on the target machine...

CVE-2017-14029

CVE-2017-14029 affects Trihedral VTScada 11.3.03 and earlier, describing an Uncontrolled Search Path Element vulnerability that lets an attacker cause the program to execute a specially crafted malicious DLL placed on the target machine. The issue is local (AV:L) with user interaction required (U...

CVE-2017-14029

An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files placed on the target machine...

XML External Entity (XXE) Processing

zendframework/zend-json is susceptible to XML external entity XXE processing attacks. The attacks can be triggered because when loading an XML formatted string into a Simple XML Element object. The fromXml function in Json.php does not validate the XML formatted string properly...

Trihedral Engineering Limited VTScada

CVSS v3 7.8 ATTENTION: Low skill level to exploit. Vendor: Trihedral Engineering Limited Equipment: VTScada Vulnerabilities: Improper Access Control, Uncontrolled Search Path Element AFFECTED PRODUCTS Trihedral Engineering Limited reports that the vulnerability affects the following versions of t...

Code injection

The Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an element...

CVE-2017-14019

An Unquoted Search Path or Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An unquoted search path or element vulnerability has been identified, which may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate his or her...

CVE-2017-14017

An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An uncontrolled search path element vulnerability has been identified, which may allow a remote attacker without privileges to execute arbitrary code in the form of a malicious DLL file...

CVE-2017-14017

CVE-2017-14017 affects Progea Movicon SCADA/HMI (Movicon 11.5.1181 and earlier). The vulnerability is an Uncontrolled Search Path Element that may allow a local attacker with low privileges to execute arbitrary code by loading a malicious DLL. Related entries also reference CVE-2017-14019 (Unquot...

CVE-2017-14019

CVE-2017-14019 is a documented vulnerability in Progea Movicon (11.5.1181 and prior) classified as an Unquoted Search Path or Element issue. The underlying flaw allows an authorized local attacker to insert arbitrary code into the unquoted service path and escalate privileges. Affected product: M...

CVE-2017-15646

Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload...

Design/Logic Flaw

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element...

SpiderControl MicroBrowser

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: SpiderControl Equipment: MicroBrowser Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following versions of SpiderControl MicroBrowser, a touch panel operating system, are affected: MicroBrowser...

Progea Movicon SCADA/HMI

CVSS v3 6.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Progea Equipment: Movicon SCADA/HMI Vulnerability: Uncontrolled Search Path Element, Unquoted Search Path or Element AFFECTED PRODUCTS The following versions of Movicon HMI, an HMI software platform, are affected:...

CVE-2017-9714

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory access may happen in limCheckRxRSNIeMatch in case incorrect RSNIE is received from the client in assoc request...

CVE-2017-11053

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when qos map set IE of length less than 16 is received in association response or in qos map configure action frame, a buffer overflow can potentially occur in ConvertQosMapsetFrame...