system menu_pxc.cgi index.cgi Code Execution

The vulnerability of the components menupxc.cgi and index.cgi of the microprogramming software for controlled switches from FL SWITCH Phoenix Contact arises from operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary...

Design/Logic Flaw

ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle can take advantage of this by inserting Javascript into the configuration files Version field...

Microsoft Windows LNK Remote Code Execution Vulnerability (CNVD-2018-16833)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A remote code execution vulnerability exists in Microsoft Windows. A remote attacker could exploit this vulnerability to execute arbitrary code...

DEF CON 2018: Critical Bug Opens Millions of HP OfficeJet Printers to Attack

LAS VEGAS – Tens of millions of fax-ready HP OfficeJet inkjet printers are vulnerable to a simple hack that gives an attacker full control over a targeted printer. Once compromised, the all-in-one OfficeJet could act as a springboard for deeper network penetration by an attacker. Here at DEF CON,...

LibreOffice Denial of Service Vulnerability (CNVD-2018-17516)

LibreOffice is a free and open source office software suite developed by The Document Foundation TDF. The suite consists of Writer text documents, Calc spreadsheets and Impress presentations and other applications. A security vulnerability exists in LibreOffice 6.0.5 and earlier versions, which...

CVE-2018-14346

GNU Libextractor before 1.7 has a stack-based buffer overflow in ecreadfilefunc unzip.c...

AZL-7012 CVE-2018-13410 affecting package zip for versions less than 3.0-5

Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an...

Design/Logic Flaw

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

MGASA-2018-0300 Updated taglib packages fix security vulnerability

The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file. CVE-2018-11439...

PBC Denial of Service Vulnerability (CNVD-2018-15646)

PBC is a Google protocol buffer library written in C. A denial of service vulnerability exists in the 'pbcPmessagedefault' function in the proto.c file of the libpbc.a static link library in PBC 2017-03-02 and earlier versions. An attacker can exploit this vulnerability to cause a denial of servi...

academiadoaprendiz.com.br Improper Access Control vulnerability

Open Bug Bounty ID: OBB-636740 Description| Value ---|--- Affected Website:| academiadoaprendiz.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

libjpeg-turbo denial of service vulnerability (CNVD-2018-11844)

libjpeg is a C library that contains JPEG decoding and JPEG encoding functions. libjpeg-turbo is an optimized version of libjpeg. A security vulnerability exists in the 'allowsarray' function in the jmemmgr.c file in libjpeg-turbo version 1.5.90. An attacker can exploit this vulnerability to caus...

Multiple Vulnerabilities in EasyService Billing 'template_().php'

EasyService Billing is a PHP-based service-oriented consumer business management system . SQL injection and cross-site scripting vulnerabilities exist in EasyService Billing 'template.php'. The vulnerabilities can be exploited to obtain sensitive database information, execute arbitrary code in th...

CVE-2018-11656

In ImageMagick 7.0.7-20 Q16 x8664, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file...

CVE-2018-5525

The CVE-2018-5525 issue affects F5 BIG-IP Configuration utility. A local-file vulnerability may allow authenticated users to retrieve files local to the BIG-IP system that contain only F5-provided data (not configuration data or customer data). Affected versions include BIG-IP 13.0.0, 12.1.0–12.1...

CVE-2018-5525

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

CVE-2018-5525: Exposure of Sensitive Information to an Unauthorized Actor

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

Espruino Buffer Overflow Vulnerability (CNVD-2018-10890)

Espruino is a JavaScript interpreter for use in microcontrollers. A stack buffer overflow vulnerability exists in versions of Espruino prior to 1.99, which stems from a failure to properly use the 'strncpy' function in the jslex.c file. An attacker can exploit this vulnerability with a specially...

CVE-2018-11624

In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file...

Information disclosure

The mobidecompresshuffmaninternal function in compression.c in Libmobi 0.3 allows remote attackers to cause information disclosure read access violation via a crafted mobi file...