CVE-2019-12136: Improper Neutralization of Input During Web Page Generation

There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element...

PT-2019-12651

Name of the Vulnerable Software and Affected Versions BoostIO Boostnote version 0.11.15 Description The issue concerns a cross-site scripting XSS problem. It can be triggered via a label named mermaid by crafting the SRC attribute of an IFRAME element. Recommendations For BoostIO Boostnote versio...

WS-2019-0529

Leptonica in versions 1.54 to 1.78.0 is vulnerable to heap-buffer-overflow in tiffReadCallback, related to src/tiffio.c...

CVE-2019-1010258: Out-of-bounds Write

nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function...

PT-2019-11531

Name of the Vulnerable Software and Affected Versions: nanosvg library versions after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 Description: The issue affects the nanosvg library, which is part of an SVG processing library. It is caused by a buffer overflow in the nsvg parseColorRGB functio...

Rockwell Automation 1799-D16U16BAGL 16 IN / 16 SRC OUT w/Analog General Purpose Discrete I/O

Binary data 752641.prm...

WS-2019-0516

open62541 before v1.0.1 and in v1.1-dev is vulnerable to use-of-uninitialized-value in json decode on src/uatypesencodingjson.c...

CVE-2017-7773: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor...

CVE-2019-9736

DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

PT-2019-19832

Name of the Vulnerable Software and Affected Versions jimmykuu Gopher version 2.0 Description The issue involves a DOM-based XSS that can be exploited through specific vectors, including the ' tag with SRC attributes containing data:image/svg+xml substrings until a patch is available. Restrict...

PT-2019-9924

Name of the Vulnerable Software and Affected Versions aubio versions 0.4.0 through 0.4.8 Description The issue is related to a NULL pointer dereference in the new aubio onset function within the src/notes/notes.c file, specifically in the new aubio notes function. Additionally, there is a Buffer...

CVE-2019-1003037: Missing Authorization

An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

Denial Of Service (DoS)

libmatio.so is vulnerable to denial of service DoS attacks. The vulnerability exists through a possible stack-based buffer over-read in a memcpy operation in MatVarReadNextInfo5 in src/mat5.c, resulting in a denial of service condition when the vulnerability is exploited...

CVE-2019-9195: Improper Limitation of a Pathname to a Restricted Directory

util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive...

WS-2019-0542

openthread in versions thread-reference-20170716 to thread-reference-2018-0926 is vulnerable to UNKNOWN READ, related to src/core/common/message.hpp...

CVE-2019-1003014: Improper Neutralization of Input During Web Page Generation

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete t...

WS-2019-0517

OpenType Sanitizer in versions v7.0.0 to v7.1.8 is vulnerable to heap-buffer-overflow in ots::OpenTypeSTAT::Serialize on src/stat.cc...

Debian DSA-4374-1 : qtbase-opensource-src - security update

Several issues were discovered in qtbase-opensource-src, a cross-platform C++ application framework, which could lead to denial-of-service via application crash. Additionally, this update fixes a problem affecting vlc, where it would start without a GUI. C Tenable Network Security, Inc. The...

[SECURITY] [DSA 4374-1] qtbase-opensource-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4374-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 28, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4374-1] qtbase-opensource-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4374-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 28, 2019 https://www.debian.org/security/faq -...