PT-2018-14379

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue is related to a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved through the...

CVE-2018-18247: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

CVE-2018-7960

There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept the packets in non-secure transmission mode. Successful exploitation may intercept and tamper with the call information, eventually cause sensiti...

Information disclosure

There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept the packets in non-secure transmission mode. Successful exploitation may intercept and tamper with the call information, eventually cause sensiti...

CVE-2018-7960: Cleartext Transmission of Sensitive Information

There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept the packets in non-secure transmission mode. Successful exploitation may intercept and tamper with the call information, eventually cause sensiti...

AutoRDPwn v4.5 - The Shadow Attack Framework

AutoRDPwn is a script created in Powershell and designed to automate the Shadow attack on Microsoft Windows computers. This vulnerability allows a remote attacker to view his victim's desktop without his consent, and even control it on request. For its correct operation, it is necessary to comply...

Code Execution Vulnerability in PHP7CMS

PHP7 content management system referred to as PHP7CMS by Chunjie studio using PHP7 technology newly developed content management program. A code execution vulnerability exists in PHP7CMS. The vulnerability is due to Modulecreate.php lack of filtering of $data'icon', an attacker can take advantage...

GNOME security, bug fix, and enhancement update

PackageKit 1.1.10-1.0.1 - remove PackageKit-0.3.8-Fedora-Vendor.conf.patch 1.1.10-1 - New upstream release - Resolves: 1576494 accountsservice 0.6.50-2 - Fix user switching Resolves: 1597350 0.6.50-1 - Update to 0.6.50 Related: 1576538 Related: 1596735 Related: 1602918 0.6.49-1 - Update to 0.6.49...

accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in userchangeiconfileauthorizedcb in user.c...

Foxit Reader and Foxit PhantomPDF for Windows Memory Misreference Vulnerability (CNVD-2018-23726)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. A memory misreference vulnerability exists in the handling of the attachIcon attribute of the Annotation object in Foxit Reader...

Memory Corruption Vulnerability in Softmedia Icon Master, Softmedia Magic, Qingdao (CNVD-2018-19757)

Softmedia Icon Master is an icon management software with functions such as icon extraction, icon replacement, icon format conversion and icon cache repair. There is a memory corruption vulnerability in Softmedia Icon Master, which allows an attacker to cause the program to crash by constructing...

Memory Corruption Vulnerability in Softmedia Icon Master of Qingdao Softmedia Magic Cube

Softmedia Icon Master is an icon management software with functions such as icon extraction, icon replacement, icon format conversion and icon cache repair. There is a memory corruption vulnerability in Softmedia Icon Master, which allows an attacker to cause the program to crash by constructing...

XnView Denial of Service Vulnerability (CNVD-2019-10273)

XnView is a multi-platform software that supports image viewing, conversion and editing. A denial of service vulnerability exists in XnView 2.45, which can be exploited by remote attackers to cause a denial of service via a specially crafted ICO file...

Microsoft Windows SCF File Feature Bypass

Exploit Title: Microsoft Windows 'SCF' File 'Open File Security Warning' Feature Bypass Vulnerability Google Dork: N/A Date: August 3, 2018 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: http://www.microsoft.com/ Version: Windows 7 SP1, 8.1 with full...

Buffer Overflow Vulnerability in MyQuickView

MyQuickView is a powerful foreign image viewer and browser. MyQuickView is a powerful foreign image viewer and browser. The tool suffers from a buffer overflow arbitrary code execution vulnerability when processing ICO images. An attacker can cause arbitrary code execution by constructing a...

brython-server (>=2.0.3, <=2.2.1), cimage (>=1.4.1, <=1.4.2) +7 more potentially affected by CVE-2016-0775 via pillow (2.9.0)

pillow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - brython-server =2.0.3, =1.4.1, =0.0.1, =1.0.7, =0.6.1, =0.1.1, =0.5.28, =0.0.1.dev0, =1.0.0b1 Source cves: CVE-2016-0775 Source advisory:...

brython-server (>=2.0.3, <=2.2.1), cimage (>=1.4.1, <=1.4.2) +7 more potentially affected by CVE-2016-2533 via pillow (2.9.0)

pillow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - brython-server =2.0.3, =1.4.1, =0.0.1, =1.0.7, =0.6.1, =0.1.1, =0.5.28, =0.0.1.dev0, =1.0.0b1 Source cves: CVE-2016-2533 Source advisory:...

brython-server (>=2.0.3, <=2.2.1), cimage (>=1.4.1, <=1.4.2) +7 more potentially affected by CVE-2016-9189 via pillow (2.9.0)

pillow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - brython-server =2.0.3, =1.4.1, =0.0.1, =1.0.7, =0.6.1, =0.1.1, =0.5.28, =0.0.1.dev0, =1.0.0b1 Source cves: CVE-2016-9189 Source advisory:...

CVE-2018-14036

CVE-2018-14036 : Affected component is AccountsService (before 0.6.50) with an insufficient path check in user_change_icon_file_authorized_cb() in user.c, enabling a directory traversal via ../ sequences. Public references in Ubuntu USN-4616-1, SUSE/SUSE-SU advisories, and OpenVAS/Nessus entries ...

PT-2018-12292

Name of the Vulnerable Software and Affected Versions AccountsService versions prior to 0.6.50 Description The issue arises from an insufficient path check in the user change icon file authorized cb function, located in user.c, allowing Directory Traversal with ../ sequences. Recommendations For...