2918 matches found
CVE-2017-11555
There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service...
UBUNTU-CVE-2017-11555
There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service...
CVE-2017-11555
CVE-2017-11555 refers to an illegal address access in LibSass 3.4.5, specifically in Sass::Eval::operator() (eval.cpp). A crafted input can cause a remote denial of service. Connected sources indicate this family of DoS issues is addressed in later vendor advisories (e.g., openSUSE-2017-1250) whi...
CVE-2017-11555
There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service...
PHPUnit RCE Vulnerability
PHPUnit is one of the PHP-based testing framework. A security vulnerability exists in the Util/PHP/eval-stdin.php file in PHPUnit versions prior to 4.8.28 and 5.x versions prior to 5.6.3. A remote attacker can exploit this vulnerability by sending HTTP POST data beginning with the string '?php' t...
Remote Code Execution (RCE)
phpunit is vulnerable to remote code execution RCE attacks. A malicious user can inject and execute arbitrary PHP script by using the ?php tag and sending a POST request to the eval-stdin.php file on the system...
UBUNTU-CVE-2017-9841
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...
Code injection
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...
E2open Device OpenWebif Plugin Arbitrary Code Execution Vulnerability
OpenWebif plugin for E2 open devices is a Web interface plugin for E2open devices from E2open, Inc. A security vulnerability exists in versions of the OpenWebif plugin for E2open devices prior to version 1.2.4, which originates from the 'saveConfig' function in...
Remote Code Execution (RCE)
kmc is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
mongo-edit is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
mongui is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
mongoosify is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
nameless-cli is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
nd-validator is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
m2m-supervisor is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Sandbox Breakout
Overview Affected versions of safe-eval are vulnerable to a sandbox escape. By accessing object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox. Proof of Concept: This code accesses the process object and calls .exit var safeEv...
Command Execution Through Collection Name
summit is vulnerable to command execution. There is an unsafe eval in summit which allows an attacker to execute arbitrary commands through a malicious collection name. This only happens when using the PouchDB driver...