PT-2019-12687

Name of the Vulnerable Software and Affected Versions sylius/sylius versions 1.0.x through 1.0.18 sylius/sylius versions 1.1.x through 1.1.17 sylius/sylius versions 1.2.x through 1.2.16 sylius/sylius versions 1.3.x through 1.3.11 sylius/sylius versions 1.4.x through 1.4.3 sylius/grid versions 1.0...

Cross-site Scripting (XSS)

express-validator is vulnerable to cross-site scripting XSS. The vulnerability exists as it was possible to bypass the sanitize function as the toString function does not sanitize arrays...

Arbitrary Code Execution

Oracle Java SE is vulnerable to arbitrary code execution attacks. Remote unauthenticated attackers could execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager...

PT-2019-1920 · Twig +2 · Twig +2

Name of the Vulnerable Software and Affected Versions: Twig versions prior to 1.38.0 Twig versions 2.x prior to 2.7.0 Description: A sandbox information disclosure issue exists because, under some circumstances, it is possible to call the toString method on an object even if not allowed by the...

UBUNTU-CVE-2018-19789

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method e.g. setNamestring $name of a class that's the dataclass of a form, and when a...

Path traversal vulnerability in Stapler allowed accessing internal data

A path traversal vulnerability in Stapler allowed viewing routable objects with views defined on any type. This could be used to access internal data of routable objects, commonly by showing their string representation toString...

Regular Expression Denial Of Service (ReDoS)

jasmine-core is vulnerable to a Regular Expression Denial of Service ReDoS attack. The regular expression ^\sfunction\s\w\s\ is used to obtain the function name from the JS toString output of a function, which can result in a matching time of approximately 10 seconds for data that is 64K...

CVE-2016-7564

Heap-based buffer overflow in the FptoString function in jsfunction.c in Artifex Software MuJS allows attackers to cause a denial of service crash via crafted input...

PT-2017-9224

Name of the Vulnerable Software and Affected Versions Artifex Software MuJS affected versions not specified Description The issue is related to a heap-based buffer overflow in the Fp toString function in jsfunction.c, which can be triggered by crafted input. This can cause a denial of service,...

UBUNTU-CVE-2016-9138

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::toString with DateInterval::wakeup...

PT-2017-2450

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.28 PHP versions 7.x prior to 7.0.13 Description The issue is related to the mishandling of property modification during wakeup processing in PHP, allowing remote attackers to cause a denial of service or possibly have...

CVE-2016-7504

A use-after-free vulnerability was observed in RptoString function of Artifex Software, Inc. MuJS before 5c337af4b3df80cf967e4f9f6a21522de84b392a. A successful exploitation of this issue can lead to code execution or denial of service condition...

CVE-2016-7504

A use-after-free vulnerability was observed in RptoString function of Artifex Software, Inc. MuJS before 5c337af4b3df80cf967e4f9f6a21522de84b392a. A successful exploitation of this issue can lead to code execution or denial of service condition...

PT-2016-7352

Name of the Vulnerable Software and Affected Versions MuJS versions prior to 5c337af4b3df80cf967e4f9f6a21522de84b392a Description A use-after-free issue was found in the Rp toString function, which can be exploited to achieve code execution or cause a denial of service condition. Recommendations...

CVE-2016-3897

The WifiEnterpriseConfig class in net/wifi/WifiEnterpriseConfig.java in Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 includes a password in the return value of a toString method call, which allows attackers to obtain sensitive information vi...

Design/Logic Flaw

The WifiEnterpriseConfig class in net/wifi/WifiEnterpriseConfig.java in Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 includes a password in the return value of a toString method call, which allows attackers to obtain sensitive information vi...

CVE-2016-3897

The WifiEnterpriseConfig class in net/wifi/WifiEnterpriseConfig.java in Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 includes a password in the return value of a toString method call, which allows attackers to obtain sensitive information vi...

CVE-2016-3897: Exposure of Sensitive Information to an Unauthorized Actor

The WifiEnterpriseConfig class in net/wifi/WifiEnterpriseConfig.java in Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 includes a password in the return value of a toString method call, which allows attackers to obtain sensitive information vi...

PT-2016-5727

Name of the Vulnerable Software and Affected Versions Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-09-01 Description The issue allows attackers to obtain sensitive information via a crafted applicatio...

Adobe Flash Player Security Bypass (APSB16-18: CVE-2016-4139)

When calling window location toString or comparing window location toString is called an attacker can return arbitrary values. An attacker can make the applet believe that it is embedded inside the hosting page, by overriding window location toString. Hence, an attacker can call any method that i...