mruby Denial of Service Vulnerability (CNVD-2018-14714)

mruby is a lightweight implementation of the Ruby language. A security vulnerability exists in the 'initcopy' function of the kernel.c file in mruby version 1.4.1. An attacker can exploit this vulnerability to cause a denial of service uninitialized pointer usage and application crash...

Denial of Service Vulnerability in MMS Protocol Initialization of Sifang CSI-200EA Measurement and Control Device

CSI-200EA measurement and control device is mainly used in substation automation system of 110kV and above voltage level. A denial of service vulnerability exists in the initialization of the MMS protocol of the Sifang CSI-200EA measurement and control device. An attacker can cause the device por...

Virtuozzo 7 : readykernel-patch (VZA-2018-036)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - It was found that sctpmakechunk function did not check if the chunk length for INIT and INITACK packets was within the...

Cross site scripting

i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but i...

CVE-2017-16010

CVE-2017-16010 : In i18next, if you call init with interpolation options and do not set escapeValue, the value defaults to undefined, causing user input to be unescaped and enabling cross-site scripting. Affected: i18next 2.0.0 and later. Exploitation details and proof-of-concept are described in...

CVE-2017-16010

Removed by vendor...

CVE-2016-8656

Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege escalation...

jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation

It was discovered that the jboss init script performed unsafe file handling which could result in local privilege escalation...

jboss: jbossas writable config files allow privilege escalation

It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group root:jboss, 664. On systems using classic /etc/init.d init scripts i.e. on Red Hat Enterprise Linux 6 a...

HDF5 Divide by Zero Error Vulnerability

HDF5 is a free suite of tools for managing the storage of different types of data that can be managed, manipulated, viewed, analyzed, and generated in portable formats. A security vulnerability exists in the 'H5Dchunkinit' function in the H5Dchunk.c file in HDF5 version 1.10.2. A remote attacker...

DEBIAN-CVE-2018-11207

A division by zero was discovered in H5Dchunkinit in H5Dchunk.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack...

DEBIAN-CVE-2018-10115

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service segmentation fault or execute arbitrary code via a crafted RAR archive...

libreoffice/ww6fuzzer: Stack-use-after-return in SwIndex::Init

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5465364275134464 Project: libreoffice Fuzzer: libFuzzerlibreofficeww6fuzzer Fuzz target binary: ww6fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

[SECURITY] Fedora 27 Update: corosync-2.4.4-1.fc27

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

Ffmpeg Denial of Service Vulnerability (CNVD-2018-08557)

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A security vulnerability exists in the 'decodeinit' function in the libavcodec/utvideodec.c file in FFmpeg 3.4.2 and earlier versions. A remote attacker can exploit this vulnerability to...

CVE-2014-1226

The pipeinitterminal function in main.c in s3dvt allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier. NOTE: This vulnerability exists because of an incomplete fix for CVE-2013-6876...

Bitmessage PyBitmessage Code Execution Vulnerability

Bitmessage PyBitmessage is a cryptographic decentralized communication protocol. Bitmessage PyBitmessage version 0.6.2 and commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0 and later have a vulnerability in the src/messagetypes/init.py file's ' constructObject' function has a security vulnerability...

mysql: unsafe chmod/chown use in init script (CPU Jan 2017)

Multiple flaws were found in the way the MySQL init script handled initialization of the database data directory and permission setting on the error log file. The mysql operating system user could use these flaws to escalate their privileges to root...

Red Hat Ceph Denial of Service Vulnerability

Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system without a single point of failure based on POSIX Portable Operating System Interface so that data can be fault-tolerant and seamlessly replicated...

YzmCMS Eval Injection Vulnerability

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A security vulnerability exists in the yzmphp/core/function/global.func.php file in YzmCMS version 3.7.1. A remote attacker can exploit this vulnerability by executing arbitrary code with the PHP...