CVE-2017-2239

Marp versions v0.0.10 and earlier may allow an attacker to access local resources and files using JavaScript...

CVE-2017-2239

Marp versions v0.0.10 and earlier may allow an attacker to access local resources and files using JavaScript...

Code injection

Marp versions v0.0.10 and earlier may allow an attacker to access local resources and files using JavaScript...

CVE-2017-2239

CVE-2017-2239 affects Marp v0.0.10 and earlier, where JavaScript in Markdown contents can access local resources/files due to improper access control. The JVN entry confirms impact: local files may be read and leaked. Remediation is to update to Marp v0.0.11, which restricts JavaScript from acces...

CVE-2017-2239

Marp versions v0.0.10 and earlier may allow an attacker to access local resources and files using JavaScript...

Denial Of Service (DoS)

FOSUserBundle is vulnerable to denial of service DoS attacks. A malicious user can pass a very long password to the application that will result in an expensive hash computation, causing the application to run out of resources and crash...

AdBlock Filter Injection Vulnerability

AdBlock is an open source ad blocking plugin dedicated to GoogleChrome. A security vulnerability exists in versions of AdBlock prior to 2.21. A remote attacker can exploit the vulnerability to block arbitrary resources on any website and disable arbitrary blocking filters...

CVE-2016-10396

The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in...

CVE-2017-1264

IBM Security Guardium 10.0 does not prove or insufficiently proves that the actors identity is correct which can lead to exposure of resources or functionality to unintended actors. IBM X-Force ID: 124739...

Xxe

IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634...

IBM Security Guardium Security Bypass Vulnerability

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes easy UI customization, report management and discovery and a streamlined audit process builder. A security bypass vulnerability exists in IBM Security...

The vulnerability of the android operating system’s sound driver ioctl handler allows a hacker to cause the device to freeze or fail to function properly.

The vulnerability of the Android operating system’s sound driver ioctl handler arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow a malicious actor to cause the device to become unresponsive or to fail to function properly...

Save Time by Streamlining Vendor Risk Assessments in the Cloud

As your organization enthusiastically adopts cloud and mobile services from multiple new vendors, are your already-busy security and compliance teams scrambling to assess the risks of using these new providers’ products? Are you still using a manual process for conducting these vendor evaluations...

JVN#21174546: Marp vulnerable to improper access control in JavaScript execution

Marp is a tool to create a presentation PDF with Markdown. Marp executes JavaScript inside the Markdown contents. Marp allows JavaScript to access local resources and files CWE-284. Impact When reading specially crafted Markdown contents, local files may be accessed and leaked to an external...

CVE-2017-1322

IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125918...

CVE-2017-1322

CVE-2017-1322 affects IBM API Connect 5.0.6.0 (and related versions) with an XML External Entity Injection (XXE) when processing XML data. Root cause: XXE vulnerability in XML parsing that can disclose sensitive information and consume memory/resources. Affected versions include 5.0.6.0; CNVD not...

The smart, alert, strong, kind, and brave way to Internet awesome

Mom and Dad, do you know when to start talking to your kids about internet safety? Google’s new Be Internet Awesome program might just be the perfect topic to start off that conversation. Launched this National Internet Safety Month, Be Internet Awesome aims to teach kids to explore the internet...

BSA-2017-332

Security Advisory ID : BSA-2017-332 Component : IBM JDK Revision : 3.0: Final IBM JDK versions 6.0.16.45, 7.0.10.5, 7.1.4.5, and 8.0.4.5 correct a security issue. IBMSDK, Java Technology Edition is vulnerable XML External Entity Injection XXE error when processing XML data. A remote attacker coul...

UBUNTU-CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

Vulnerability in the Core Kernel of the Android operating system, allowing a hacker to gain access to resources

The vulnerability in the Core Kernel of the Android operating system is related to improper authorization. Exploiting this vulnerability can allow a remote attacker to gain access to resources...