1221 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...
CVE-2018-8921
Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...
CVE-2018-8921
Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...
CVE-2018-8921
CVE-2018-8921 describes a cross-site scripting (XSS) vulnerability in Synology Drive’s File Sharing Notify Toast. Affected component: File Sharing Notify Toast within Synology Drive. The root cause is improper handling/sanitization of the file name, allowing remote authenticated users to inject a...
CVE-2018-8921
Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...
PT-2018-18719 · Synology · Synology Drive
Name of the Vulnerable Software and Affected Versions: Synology Drive versions prior to 1.0.2-10275 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via a malicious file name, exploiting a cross-site scripting XSS vulnerability in the File Sharing...
CVE-2017-13278
In MediaPlayerService::Client::notify of MediaPlayerService.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1...
CVE-2017-13278
CVE-2017-13278 affects Android’s MediaPlayerService::Client::notify in MediaPlayerService.cpp, with a use-after-free that can allow local elevation of privilege without extra execution privileges. Impacted Android versions: 6.0–8.1 (6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1). Description notes no u...
Google Android Local Elevation of Privilege Vulnerability (CNVD-2018-07863)
Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in MediaPlayerService::Client::notify in the MediaPlayerService.cpp file in Android. A local attacker can exploit this vulnerability...
Quagga BGP Backend Program NOTIFY Denial of Service Vulnerability
Quagga is an open source routing software. Quagga BGP backend program handling NOTIFY has a security vulnerability that allows remote attackers to exploit the vulnerability to submit special requests for denial-of-service attacks...
CVE-2018-5378
The Quagga BGP daemon bgpd prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash...
libreoffice/pptfuzzer: Bad-cast to SdrObject from invalid vptr in SdrEdgeObj::Notify
Detailed report: https://oss-fuzz.com/testcase?key=5651645263249408 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000103c9cb0 Crash State: Bad-cast to SdrObject...
PT-2018-16934 · Quagga +3 · Quagga +3
Name of the Vulnerable Software and Affected Versions: Quagga versions prior to 1.2.3 Description: The issue arises from improper bounds checking of data sent with a NOTIFY to a peer when an attribute length is invalid. This can lead to arbitrary data from the bgpd process being sent over the...
libreoffice/pptfuzzer: Heap-use-after-free in SdrObject::GetBroadcaster
Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5695662168473600 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...
libreoffice/pptfuzzer: Bad-cast to SdrObjectSdrEdgeObj::Notify in SfxBroadcaster::Broadcast
Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4773718837428224 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...
libreoffice/pptfuzzer: Heap-use-after-free in SdrObject::GetBroadcaster
Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5182633748201472 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...
The vulnerability of the `nsImageLoadingContent::Notify` function in the Mozilla Firefox ESR browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the nsImageLoadingContent::Notify function in Mozilla Firefox ESR is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
DEBIAN-CVE-2017-15091
An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly...
UBUNTU-CVE-2017-15091
An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly...
GLSA-201801-06 : Back In Time: Command injection
The remote host is affected by the vulnerability described in GLSA-201801-06 Back In Time: Command injection Back in Time did improper escaping/quoting of file paths used as arguments to the notify-send command leading to some parts of file paths being executed as shell commands within an os.syst...