Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in jonschoning/espial

Description Implement both Secure flag and httponly flag in the application. Proof of Concept Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from bein...

UBUNTU-CVE-2021-3781

A trivial sandbox enabled with the -dSAFER option escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highes...

Microsoft SAFER Bypass Vulnerability

Hi @ll, Microsoft introduced SAFER alias Software Restriction Policies SRP with Windows XP about 20 years ago. See for the API, plus the TechNet articles "How Software Restriction Policies Work" and "Using Software Restriction Policies to Protect Against Unauthorized Software" for the use case...

SUSE: Security Advisory (SUSE-SU-2019:2478-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution (RCE)

mongodb-query-parser is vulnerable to remote code execution RCE. The vulnerability exists through the use of unsafe version of safer-eval, and context-eval in the older versions. This vulnerability is related to CVE-2019-10769...

CentOS 8 : ghostscript (CESA-2019:2591)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2591 advisory. - ghostscript: Safer mode bypass by .forceput exposure in .pdfhookDSCCreator 701445 CVE-2019-14811 - ghostscript: Safer mode bypass by .forceput exposu...

FreeBSD : Ghostscript -- SAFER Sandbox Breakout (62642942-590f-11eb-a0dc-8c164582fbac)

SO-AND-SO reports : A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max...

Citrix App Layering 4.x: PVS Image Management

PVS Image Management Utility Some customers that integrate with PVS have asked for a mechanism to reduce possible errors when deploying new versions of vDisks. In PVS there are a few ways to modify the vDisk assigned to PVS targets. You can edit the properties of a target and select a vDisk from...

saferkidsandhomes.com Cross Site Scripting vulnerability OBB-1379875

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

@achil/parcel-bundler (>=1.11.1, <=1.12.34), @acies/core (>=1.2.89, <=1.2.215) +134 more potentially affected by unknown CVE via safer-eval (>=1.2.3, <=1.3.6)

safer-eval NPM version =1.2.3, =1.11.1, =1.2.89, =0.1.0, =4.0.0, =4.1.0, =4.1.2, =0.9.2-pre.41, =2.0.2-pre.3, =1.0.0, =1.9.3-ext.1, =0.3.0, =1.12.3, =1.0.0, =0.0.1, =3.4.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-876R-HJ45-FW7G...

GHSA-876R-HJ45-FW7G Sandbox Breakout / Arbitrary Code Execution in safer-eval

All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system. Recommendation The package is not suited to...

Sandbox Breakout / Arbitrary Code Execution in safer-eval

All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system. Recommendation The package is not suited to...

Sandbox Breakout / Arbitrary Code Execution in safer-eval

Withdrawn: Duplicate of GHSA-hgch-jjmr-gp7w...

Control Flow Guard for Clang/LLVM and Rust

As part of our ongoing efforts towards safer systems programming, we’re pleased to announce that Windows Control Flow Guard CFG support is now available in the Clang C/C++ compiler and Rust. What is Control Flow Guard? What is Control Flow Guard? CFG is a platform security technology designed to...

Security update for ghostscript (important)

openSUSE Security Update: Security update for ghostscript Announcement ID: openSUSE-SU-2020:1142-1 Rating: important References: 1174415 Cross-References: CVE-2020-15900 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...

SUSE SLED15 / SLES15 Security Update : ghostscript (SUSE-SU-2020:2095-1)

This update for ghostscript fixes the following issues : fixed CVE-2020-15900 Memory Corruption SAFER Sandbox Breakout cf. https://bugs.ghostscript.com/showbug.cgi?id=702582 bsc1174415 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

SUSE SLES12 Security Update : ghostscript (SUSE-SU-2020:2097-1)

This update for ghostscript fixes the following issues : fixed CVE-2020-15900 Memory Corruption SAFER Sandbox Breakout cf. https://bugs.ghostscript.com/showbug.cgi?id=702582 bsc1174415 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

The vulnerability of the .charkeys procedure in the PostScript/PDF Ghostscript interpreter allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the .charkeys procedure in the PostScript/PDF Ghostscript interpreter is related to a security protection flaw that allows scripts to bypass the "-dSAFER" restriction. Exploiting this vulnerability can enable an attacker operating remotely to gain access to confidential data,...

DEBIAN-CVE-2020-9428

In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing...

Code Injection in commenthol/safer-eval

Overview safer-eval is a safer approach for eval in node and browser. Affected versions of this package are vulnerable to Arbitrary Code Execution via generating a RangeError: Maximum call stack size exceeded. Proof of Concept Credit: Jonathan Leitschuh js const theFunction = function const f =...