The vulnerability of the PDF library in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of PDF libraries in Windows operating systems is related to improper handling of objects in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted web page or PDF file...

USN-3751-1 spice, spice-protocol vulnerability

It was discovered that Spice incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service...

ALPINE-CVE-2018-1000222

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit...

pcre: invalid memory read in _pcre32_xclass (pcre_xclass.c)

The pcre32xclass function in pcrexclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service invalid memory read via a crafted file...

Description of the security update for the font library vulnerability in Windows Server 2008, Windows Embedded POSReady 2009, and Windows Embedded Standard 2009: August 14, 2018

Description of the security update for the font library vulnerability in Windows Server 2008, Windows Embedded POSReady 2009, and Windows Embedded Standard 2009: August 14, 2018 Summary A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted...

CVE-2018-14960

Xiao5uCompany 1.7 has CSRF via admin/Admin.asp...

CVE-2018-14740

An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in setfieldone in bootstrap.c while making a query...

CVE-2017-2614

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those account...

Information Disclosure

h2 is vulnerable to information disclosures. The library doesn't check if the filename parameter in the backup command points to a symlinked directory, allowing a malicious user to gain access to sensitive information on the database...

GNU LibreDWG 'dwg_free_eed' function double release vulnerability

GNU LibreDWG is a C language library developed by the GNU Project for working with DWG files. A security vulnerability exists in the 'dwgfreeeed' function of the free.c file in GNU LibreDWG version 0.5.1048, which stems from the program's failure to properly manage the obj-eed value after a relea...

CVE-2018-14444

libdxfrw 0.6.3 has an Integer Overflow in dwgCompressor::decompress18 in dwgutil.cpp, leading to an out-of-bounds read and application crash...

CVE-2018-14401

CopyData in AxmlParser.c in AXML Parser through 2018-01-04 has an out-of-bounds read...

HTSlib Arbitrary File Overwrite Vulnerability

HTSlib is a library written in C for accessing high-throughput sequencing data such as SAM, CRAM and VCF. A competitive condition vulnerability exists in the cram/cramio.c file in HTSlib version 1.8. An attacker can exploit this vulnerability by performing a symbolic link attack to overwrite...

CVE-2018-12371

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 60.1, Thunderbird 60, an...

CVE-2018-5095

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 52.6, Firefox ESR 52.6, a...

CVE-2017-16099

The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition...

CVE-2017-0930

augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path...

CVE-2016-10686

fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2016-10542

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier...

UBUNTU-CVE-2018-11233

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory...