PT-2018-3679 · Google +9 · Libwebp +9

Name of the Vulnerable Software and Affected Versions: libwebp versions prior to 1.0.1 Description: The issue is related to a heap-based buffer overflow in the libwebp library, which is used for encoding and decoding WebP images. This can be exploited by a remote attacker to gain access to...

PT-2018-3683 · Google +9 · Libwebp +9

Name of the Vulnerable Software and Affected Versions: libwebp versions prior to 1.0.1 Description: A heap-based buffer overflow was found in libwebp, related to a buffer overflow issue when reading beyond the buffer boundaries in memory. This issue can be exploited by a remote attacker to gain...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium Data Redaction

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by IBM Security Guardium Data Redaction. IBM Security Guardium Data Redaction has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denia...

PT-2018-14897 · Phpbb Limited · Phpbb

Name of the Vulnerable Software and Affected Versions: phpBB versions prior to 3.2.4 Description: The issue allows for Remote Code Execution through Object Injection by utilizing Phar deserialization. This can be achieved by passing an absolute path to a file exists check. The exploitation of thi...

PT-2018-14822 · FFmpeg · Libav

Name of the Vulnerable Software and Affected Versions: Libav version 12.3 Description: The issue is related to an invalid memory access in the vc1 decode frame function in libavcodec/vc1dec.c, which can be exploited by attackers to cause a denial-of-service via a crafted aac file. Recommendations...

PT-2018-14766 · Mpdf · Mpdf

Name of the Vulnerable Software and Affected Versions: mPDF versions prior to 7.1.7 Description: The issue allows for Server-Side Request Forgery SSRF if mPDF is deployed as a web application that accepts arbitrary HTML. This can be demonstrated by an substring that triggers a call to getImage in...

PT-2018-16320 · Yi · Yi Home Camera

Name of the Vulnerable Software and Affected Versions: Yi Home Camera version 1.8.7.0D Description: An exploitable code execution issue exists in the firmware update functionality. A specially crafted set of UDP packets can cause a settings change, resulting in denial of service. An attacker can...

PT-2018-12645 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions through 4.1.4 Description: The issue allows a remote attacker with access to mount volumes to exploit the GF XATTROP ENTRY IN KEY xattrop, creating arbitrary, empty files on the target server via abuse of the...

PT-2018-16350 · Sophos · Sophos Hitmanpro.Alert

Name of the Vulnerable Software and Affected Versions: Sophos HitmanPro.Alert version 3.7.6.744 Description: A memory disclosure issue exists in the 0x222000 IOCTL handler functionality. This can be triggered by a specially crafted IRP request, causing the driver to return uninitialized memory an...

BlueStacks App Player fails to restrict access permissions

Overview BlueStacks App Player fails to restrict access permissions CWE-284. Masaki Kubo and Yoshiki Mori of Cybersecurity Laboratory, National Institute of Information and Communications Technology reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

PT-2018-14475 · WordPress · Wp-Live-Chat-Support

Name of the Vulnerable Software and Affected Versions: wp-live-chat-support version 8.0.15 Description: A security issue exists in the wp-live-chat-support plugin for WordPress. The problem is related to the term parameter in the "modules/gdpr.php" file. This issue can be exploited through a...

Microsoft Office: Never allow users to specify groups when restricting permission for documents

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officeneverallowdls.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Document Info Beaconing UI Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

PT-2018-2950

Name of the Vulnerable Software and Affected Versions Paramiko versions 1.17.6 through 2.4.1 Description The issue is related to insufficient access control in the Paramiko library, which can be exploited by a remote attacker to execute arbitrary code using the SSH protocol. This can result in...

Microsoft Office: Restrict File Download

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officerestrictfiledownload.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Restrict File Download Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is fre...

PT-2018-3883 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: An issue exists due to the lack of neutralization of special elements used in the command string construction within the handler function of the "/goform/sylogapply" route. This could lead to...

PT-2018-11065 · Amd · Adrenalin

Name of the Vulnerable Software and Affected Versions: Adrenalin version 5.4.0 Description: A Reflected Cross Site Scripting issue was discovered. The user-supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the "flexiportal/GeneralInfo.aspx" endpoint,...

PT-2018-13565 · Yfcmf · Yfcmf

Name of the Vulnerable Software and Affected Versions: YFCMF version 3.0 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, enabling an attacker to add an administrator account through the admin/admin/adminsave.html endpoint. Recommendations: For YFCMF version 3.0, conside...

R 3.4.4 - Buffer Overflow (SEH)

-------------------------------------------------------- Exploit Title: R v3.4.4 - SEH Buffer Overflow Exploit Exploit Author : ZwX Exploit Date: 2018-08-22 Vendor Homepage : https://www.r-project.org/ Tested on OS: Windows 7 Social: twitter.com/ZwX2a contact: [email protected] Website:...

PT-2018-13245 · Xkbcommon +4 · Xkbcommon +4

Name of the Vulnerable Software and Affected Versions: xkbcommon versions prior to 0.8.1 Description: The issue arises from unchecked NULL pointer usage in the xkbcommon parser, which can be exploited by local attackers to cause a crash due to a NULL pointer dereference. This can occur when a...

PT-2018-16311 · Sqlite Consortium +1 · Sqlite +1

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250 version 0.20.17 Description: A stack-based buffer overflow issue exists in the video-core's HTTP server due to insecure extraction of database fields from the "clips" table of its SQLite database. This can ...