FS IMDB Clone SQL Injection Vulnerability

FS IMDB Clone is a set of PHP-based scripts for online movie ticket booking websites. A SQL injection vulnerability exists in FS IMDB Clone version 1.0. The vulnerability can be exploited to inject SQL by sending the 'f' parameter to the movie.php file, the 's' parameter to the tvshow.php file, o...

CVE-2017-17588

FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or showmiscvideo.php id parameter...

PT-2017-14883

Name of the Vulnerable Software and Affected Versions FS IMDB Clone version 1.0 Description The issue concerns SQL Injection, which can be exploited via specific parameters in certain PHP files. The vulnerable parameters are f in 'movie.php', s in 'tvshow.php', and id in 'show misc video.php'...

VDE: Privilege escalation

Background VDE is an ethernet compliant virtual network that can be spawned over a set of physical computer over the Internet. Description It was discovered that Gentoo’s default VDE installation suffered from a privilege escalation vulnerability in the init script. This script calls an unsafe...

Out-of-bounds

The imspcugetcdcuniondesc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service imspcuparsecdcdata out-of-bounds read and system crash or possibly have unspecified other impact via a crafted USB device...

Gentoo net-misc/vde elevation of privilege vulnerability

The Gentoo net-misc/vde package is a set of distributed virtual networking frameworks from the Gentoo Foundation. A security vulnerability exists in versions of the Gentoo net-misc/vde package prior to 2.3.2-r4. An attacker can exploit this vulnerability to gain root privileges by creating hard...

CVE-2017-16638

The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on which "chown" is called recursively by the OpenRC service script...

CVE-2017-16638

The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on which "chown" is called recursively by the OpenRC service script...

Hardcoded credentials

The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on which "chown" is called recursively by the OpenRC service script...

CVE-2017-16638

CVE-2017-16638 affects Gentoo net-misc/vde up to version 2.3.2-r4. A privilege-escalation exists where members of the qemu group can gain root privileges by a hard link operation in a directory on which the OpenRC init script calls chown recursively. The issue is fixed by upgrading to >= net-m...

CVE-2017-16638: Incorrect Permission Assignment for Critical Resource

The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on which "chown" is called recursively by the OpenRC service script...

CVE-2017-16532

The getendpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted USB device...

CVE-2017-16532: NULL Pointer Dereference

The getendpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted USB device...

CVE-2014-8492: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 sitename, 2 message, or 3 siteurl parameter...

PT-2017-6241

Name of the Vulnerable Software and Affected Versions Profile Builder plugin versions prior to 2.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the site name, message, or site url parameters in the assets/misc/fallback-page.php file. Recommendations F...

radare2 'grub_memmove' function denial of service vulnerability

radare2 is a set of libraries and tools for working with binary files. A security vulnerability exists in the 'grubmemmove' function in the shlr/grub/kern/misc.c file in radare2 version 1.5.0. A remote attacker can exploit this vulnerability to cause a denial of service stack-based buffer overflo...

CVE-2017-6560: Improper Neutralization of Input During Web Page Generation

XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=misc&action=XSS&editObjId=XSS attack...

PT-2017-17158

Name of the Vulnerable Software and Affected Versions Agora-Project version 3.2.2 Description The issue is related to a cross-site scripting XSS attack. The attack can be performed using the "index.php?ctrl=misc&action=XSS&editObjId=XSS" endpoint, where action and editObjId are vulnerable...

GLSA-201702-19 : TigerVNC: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-201702-19 TigerVNC: Buffer overflow A buffer overflow vulnerability in ModifiablePixelBuffer::fillRect in vncviewer was found. Impact : A remote attacker, utilizing a malicious VNC server, could execute arbitrary code with the...

CVE-2016-6681: Exposure of Sensitive Information to an Unauthorized Actor

drivers/misc/qcom/qdsp6v2/audioutils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug...