PBC Denial of Service Vulnerability (CNVD-2018-15646)

PBC is a Google protocol buffer library written in C. A denial of service vulnerability exists in the 'pbcPmessagedefault' function in the proto.c file of the libpbc.a static link library in PBC 2017-03-02 and earlier versions. An attacker can exploit this vulnerability to cause a denial of servi...

academiadoaprendiz.com.br Improper Access Control vulnerability

Open Bug Bounty ID: OBB-636740 Description| Value ---|--- Affected Website:| academiadoaprendiz.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

libjpeg-turbo denial of service vulnerability (CNVD-2018-11844)

libjpeg is a C library that contains JPEG decoding and JPEG encoding functions. libjpeg-turbo is an optimized version of libjpeg. A security vulnerability exists in the 'allowsarray' function in the jmemmgr.c file in libjpeg-turbo version 1.5.90. An attacker can exploit this vulnerability to caus...

Multiple Vulnerabilities in EasyService Billing 'template_().php'

EasyService Billing is a PHP-based service-oriented consumer business management system . SQL injection and cross-site scripting vulnerabilities exist in EasyService Billing 'template.php'. The vulnerabilities can be exploited to obtain sensitive database information, execute arbitrary code in th...

CVE-2018-11656

In ImageMagick 7.0.7-20 Q16 x8664, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file...

CVE-2018-5525

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

CVE-2018-5525

The CVE-2018-5525 issue affects F5 BIG-IP Configuration utility. A local-file vulnerability may allow authenticated users to retrieve files local to the BIG-IP system that contain only F5-provided data (not configuration data or customer data). Affected versions include BIG-IP 13.0.0, 12.1.0–12.1...

Espruino Buffer Overflow Vulnerability (CNVD-2018-10890)

Espruino is a JavaScript interpreter for use in microcontrollers. A stack buffer overflow vulnerability exists in versions of Espruino prior to 1.99, which stems from a failure to properly use the 'strncpy' function in the jslex.c file. An attacker can exploit this vulnerability with a specially...

CVE-2018-11624

In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file...

Information disclosure

The mobidecompresshuffmaninternal function in compression.c in Libmobi 0.3 allows remote attackers to cause information disclosure read access violation via a crafted mobi file...

Remote Code Execution (RCE)

libfontforge.so is vulnerable to remote code execution RCE attacks.A malicious user can pass a ttf file to the getsid function in the parsettf.c file to cause a buffer over-read that can crash the application or cause arbitrary code to be executed...

DEBIAN-CVE-2018-1122

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the configfile function...

CVE-2018-1263

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

CVE-2018-11035

In 2345 Security Guard 3.7, the driver file 2345NsProtect.sys, X64 version allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCTL 0x80002019...

CVE-2018-1261

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

CVE-2018-10976

In 2345 Security Guard 3.7, the driver file 2345BdPcSafe.sys, X64 version allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCTL 0x00222050...

The vulnerability of the UploadFileOnUIServerServlet component in the HPE UCMDB database configuration units allows a attacker to execute arbitrary code.

The vulnerability of the UploadFileOnUIServerServlet component in the HPE UCMDB Universal Configuration Management Database is related to deficiencies in path name validation for restricted access directories. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code i...

CVE-2018-8974

Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial 'Sourcescript type="text/javascript" src=' line. Fix released on 2018-03-28...

CVE-2017-2918

An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An...

CVE-2017-2899

An exploitable integer overflow exists in the TIFF loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.tif' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application...