Contiki-NG Buffer Over-Read Vulnerability

Contiki-NG is an open source cross-platform operating system for next-generation IoT devices. A buffer over-read vulnerability exists in lookup in os/storage/antelope/lvm.c in Contiki-NG 4.1 and earlier versions when parsing AQL, which can be exploited by an attacker to cause a denial of service...

PT-2018-13750 · Mongodb +3 · Libbson +3

Name of the Vulnerable Software and Affected Versions: libbson version 1.12.0 Description: The issue is related to a heap-based buffer over-read in the bson iter next internal function in bson-iter.c via a crafted bson buffer. Recommendations: For libbson version 1.12.0, at the moment, there is n...

CVE-2018-16665

An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvmshiftforoperator in os/storage/antelope/lvm.c...

CVE-2018-16663

An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parserelations in os/storage/antelope/aql-parser.c while parsing AQL storage of relations...

@atlauncher/atlauncher-scripts (>=0.1.0-18 <=0.1.0-19), @atomist/sample-sdm (>=0.5.1-atomist-update-latest-1540938130032.20181101043939 <=0.5.1-master.20181101044648) +415 more potentially affected by CVE-2018-16487 +1 more via lodash.merge (>=4.0.1 <=4.6.1)

lodash.merge NPM version =4.0.1, =0.1.0-18, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =5.3.8, =3.1.0, =5.0.0, =5.2.7, =5.2.8, =6.1.1, =5.0.0, =5.0.0, =5.2.8, =5.1.1, =0.1.3, =6.2.6, =6.3.3 and more Source cves: CVE-2018-16487, CVE-2018-3721 Source advisory:...

profiles.prothomalo.com XSS vulnerability

Open Bug Bounty ID: OBB-670919 Description| Value ---|--- Affected Website:| profiles.prothomalo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Intel CPU Foreshadow-NG (foreshadow next generation version) vulnerability (CNVD-2018-15494)

The L1 endpoint failure VMM vulnerability, like CVE-2018-3620, belongs to Foreshadow-NG foreshadowed next-generation version, and similarly, other vendor CPUs may be affected as well.Using the speculation of executing side-channel attacks, an attacker with local user access privileges can achieve...

Intel CPU Foreshadow-NG (foreshadow next-generation version) Vulnerability

The L1 Terminal Malfunction OS/SMM vulnerability is different for Intel CPUs with SGX Software Protection Extensions technology, and may also affect CPUs from other vendors. With the speculative execution of a side-channel attack, an attacker with local user access could achieve an unauthorized...

Google Cloud NEXT '18: A Growing Event with Much to Offer

If you want to learn whats up and coming for Google Cloud and make some great connections, Google Cloud NEXT is an informative, lively event to prioritize on your conference calendar. Coalfire attended the recent Google Cloud NEXT 18 conference in San Francisco July 24-27 and found it to be a goo...

IBM Rational DOORS Next Generation Cross-Site Scripting Vulnerability

IBM Rational DOORS Next Generation DNG/RRC is a suite of software for capturing, tracking, analyzing, and managing requirements from IBM, USA. The software provides a single platform for global team collaboration to manage requirements more efficiently, sharing unified users, servers and project...

CVE-2018-1422

CVE-2018-1422 affects IBM Jazz Foundation-based products, notably IBM Rational DOORS Next Generation (DNG/RRC) versions 5.0–5.0.2 and 6.0–6.0.5. The issue is a cross-site scripting vulnerability that lets an attacker embed arbitrary JavaScript in the Web UI, potentially leading to credentials dis...

Security Bulletin: Vulnerabilities in Rational DOORS Next Generation with potential for Cross-Site Scripting attack (CVE-2018-1422)

Summary Vulnerabilities in Rational DOORS Next Generation with potential for Cross-Site Scripting attack. Vulnerability Details CVEID: CVE-2018-1422 DESCRIPTION: IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...

CVE-2018-14474

CVE-2018-14474 affects Orange Forum 1.4.0, with an open redirect in views/auth.go triggered by the next parameter to /login or /signup. The vulnerability allows an attacker to redirect users to a malicious site, potentially enabling phishing or credential theft. Several connected sources (e.g., N...

IBM Rational DOORS Next Generation and IBM Rational Requirements Composer Cross-Site Scripting Vulnerabilities

IBM Rational DOORS Next Generation DNG and Rational Requirements Composer RRC are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. A cross-site scripting vulnerability exists in IB...

ALPINE-CVE-2018-14423

Division-by-zero vulnerabilities in the functions pinextpcrl, pinextcprl, and pinextrpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service application crash...

CVE-2018-1529

IBM Rational DOORS Next Generation 5.0 through 5.0.2, 6.0 through 6.0.5 and IBM Rational Requirements Composer 5.0 through 5.0.2 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

CVE-2018-1529

IBM Rational DOORS Next Generation 5.0 through 5.0.2, 6.0 through 6.0.5 and IBM Rational Requirements Composer 5.0 through 5.0.2 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

Cross site scripting

IBM Rational DOORS Next Generation 5.0 through 5.0.2, 6.0 through 6.0.5 and IBM Rational Requirements Composer 5.0 through 5.0.2 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

CVE-2018-1529

CVE-2018-1529 affects IBM Rational DOORS Next Generation (DNG) 5.0–5.0.2 and 6.0–6.0.5, and IBM Rational Requirements Composer 5.0–5.0.2, exposing cross-site scripting via the Web UI that could lead to credentials disclosure in a trusted session. Remediation provided by IBM fixes: upgrade Rationa...

CVE-2018-1529

IBM Rational DOORS Next Generation 5.0 through 5.0.2, 6.0 through 6.0.5 and IBM Rational Requirements Composer 5.0 through 5.0.2 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...