PBC denial of service vulnerability

PBC is a Google protocol buffer library written in C. A denial of service vulnerability exists in the 'pbcBregisterfields' function in the bootstrap.c file of the libpbc.a static link library in PBC 2017-03-02 and earlier versions. An attacker can exploit this vulnerability to cause a denial of...

DEBIAN-CVE-2018-12536

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

spark: Absolute and relative pathnames allow for unintended static file disclosure

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark...

nodeaaaaa Directory Traversal Vulnerability

nodeaaaaa is a static file server. A directory traversal vulnerability exists in nodeaaaaa. An attacker can gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

node-srv path traversal vulnerability

node-srv is a static Node.js server with support for Heroku and Grunt.js. A path traversal vulnerability exists in node-srv, which stems from the program's lack of url checksums. An attacker can exploit this vulnerability to read the contents of an arbitrary file with a known path...

liyujing path traversal vulnerability

liyujing is a static file server. A path traversal vulnerability exists in liyujing. An attacker can exploit this vulnerability by placing a '... /' sequence in the URL to gain access to the file system...

node-server-forfront path traversal vulnerability

node-server-forfront is a static file server. A path traversal vulnerability exists in node-server-forfront. An attacker can gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

Serverzyy Path Traversal Vulnerability

serverzyy is a static file server. A path traversal vulnerability exists in serverzyy. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

Lightweight and Practical Kernel Protector for x86: Shadow-Box

Shadow-box is a security monitoring framework for operating systems using state-of-the-art virtualization technologies. Shadow-box has a novel architecture inspired by a shadow play. We made Shadow-box from scratch, and it is primarily composed of a lightweight hypervisor and a security monitor...

Directory Traversal

file-static-server is vulnerable to directory traversal attacks. The attack is possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...

Security Bulletin: ISC DHCP vulnerability affects TS4500 Tape Library (CVE-2018-5732)

Summary The TS4500 Tape Library may be vulnerable to a denial of service attack if dynamic addressing DHCP is used. Vulnerability Details CVEID: CVE-2018-5732 DESCRIPTION: ISC DHCP is vulnerable to a denial of service, caused by a buffer overflow in dhclient. By sending a specially crafted...

Augustine Path Traversal Vulnerability

augustine is a static HTTP server used in Node.js. A path traversal vulnerability exists in augustine, which stems from the program's lack of url validation. The vulnerability can be exploited by sending a specially crafted GET request to read the contents of an arbitrary file with a known path...

Security update for bouncycastle (moderate)

This update for bouncycastle to version 1.59 fixes the following issues: These security issues were fixed: - CVE-2017-13098: BouncyCastle, when configured to use the JCE Java Cryptography Extension for cryptographic functions, provided a weak Bleichenbacher oracle when any TLS cipher suite using...

626 node module path traversal vulnerability

626 node module is a static server. A path traversal vulnerability exists in 626 node module, which stems from the program failing to filter the path of a requested file. An attacker could use this vulnerability to read the contents of an arbitrary file...

mcstatic node module path traversal vulnerability (CNVD-2018-11446)

The mcstatic node module is a static server. A path traversal vulnerability exists in mcstatic node module, which stems from the program's lack of file path detection. An attacker can exploit this vulnerability to read the contents of an arbitrary file...

public node module path traversal vulnerability

The public node module is a module that can run a static file hosting server using a public directory and port. A path traversal vulnerability exists in the public node module, which stems from the program's lack of detection of file paths. An attacker could use this vulnerability to read the...

Siemens SCALANCE X Switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C (Update D)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable from the same local network segment OSI Layer 2 Vendor: Siemens Equipment: SCALANCE X switches, RUGGEDCOM Win, RFID 181-EIP, and SIMATIC RF182C Vulnerability: Heap-based Buffer Overflow 2. UPDATE INFORMATION This updated advisory is a...

CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

ecstatic node module denial of service vulnerability

ecstatic node module is a http cooperative static file server middleware . A security vulnerability exists in ecstatic node module versions prior to 1.4.0. An attacker can exploit this vulnerability to cause a denial of service crash by sending input with the help of the If-Modified-Since packet...

Directory Traversal

static-html-server is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...