SQL injection vulnerability in the api.class.php page of UQCMS Cloud Business B2B2C Multi-store System

UQCMS cloud business system is a B2B2C e-commerce software with the program using PHP+MYSQL and the template using smarty template. A SQL injection vulnerability exists in the api.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System due to the program's failure to adequately filter...

Heap overflow

WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service bitstream.c MagickBitStreamMSBWrite heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted file...

Debian DLA-1201-1 : libxcursor security update

It was discovered that libXcursor, a X cursor management library, is prone to several heap overflows when parsing malicious files. An attacker can take advantage of these flaws for arbitrary code execution, if a user is tricked into processing a specially crafted cursor file. For Debian 7 'Wheezy...

CVE-2017-17102

Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $REQUEST'link'...

CVE-2017-2919

An exploitable stack based buffer overflow vulnerability exists in the xlsgetfcell function of libxls 1.3.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability...

CVE-2017-1000199

tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handlerqcow.so resulting in non-privileged users being able to check for existence of any file with root privileges...

UBUNTU-CVE-2017-16832

The pebfdreadbuildid function in peicode.h in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a denial of service segmentation violation and applicatio...

DEBIAN-CVE-2017-16832

The pebfdreadbuildid function in peicode.h in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a denial of service segmentation violation and applicatio...

Code execution vulnerability in Axublog ad/theme.php file

Axublog is a PHP personal blog system. A code execution vulnerability exists in the Axublog ad/theme.php file. The vulnerability is due to the program failing to filter the parameters passed, an attacker can exploit the vulnerability to construct a specially crafted file, upload a shell, and obta...

SQL injection vulnerability in EML enterprise address book management system action.address.php file

EML enterprise customer relationship management system is based on Linux open kernel and Apache based Php + Mysql intelligent B / S interactive service system. A SQL injection vulnerability exists in the EML Enterprise Contacts Management System action.address.php file. An attacker can exploit th...

CVE-2017-12783

The ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service assert fault via a crafted mkv file...

SUSE-SU-2017:2950-1 Security update for jq

This update for jq fixes the following issues: Security issues fixed: - CVE-2016-4074: The jvdumpterm function in jq allowed remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. bsc1014176 Non-security issues fixed: - Update tests...

GNU Binutils Binary File Descriptor Library Buffer Overflow Vulnerability

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utilities developed by the GNU Project to work with object files in a variety of formats, with connectors, assemblers, and other tools for object files and archives.The Binary File Descriptor BFD library a.k.a...

Nice PHP FAQ Script SQL Injection Vulnerability

Nice PHP FAQ Script is a PHP-based website autoresponder script. A SQL injection vulnerability exists in Nice PHP FAQ Script. The vulnerability can be exploited to inject SQL commands by sending the 'nicetheme' parameter to the index.php file...

GNU Emacs Information Disclosure Vulnerability

GNU Emacs is a Unix text editor written in C developed by the GNU Project, which supports syntax highlighting, multiple languages and feature extensions. A security vulnerability exists in GNU Emacs version 25.3.1, which stems from the program's failure to use a mask when creating swap files. An...

SQL Injection Vulnerability in APPCMS index.php File

APPCMS is a professional APP content management system. A SQL injection vulnerability exists in the index.php file of APPCMS version 1.3.855. An attacker can exploit this vulnerability to obtain sensitive database information or perform unauthorized operations...

Memory corruption vulnerability exists in Sohu Video 5 (CNVD-2017-35531)

Sohu Video 5 is a video player from Sohu. A memory corruption vulnerability exists in the Sohu Video 5 PC client when opening certain mov files, which can be exploited by attackers to cause a denial of service or code execution...

CVE-2017-15737

IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at CADIMAGE+0x00000000003d246f."...

CVE-2017-14017

An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An uncontrolled search path element vulnerability has been identified, which may allow a remote attacker without privileges to execute arbitrary code in the form of a malicious DLL file...

CVE-2017-14017

CVE-2017-14017 affects Progea Movicon SCADA/HMI (Movicon 11.5.1181 and earlier). The vulnerability is an Uncontrolled Search Path Element that may allow a local attacker with low privileges to execute arbitrary code by loading a malicious DLL. Related entries also reference CVE-2017-14019 (Unquot...