11105 matches found
CVE-2017-12439
SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...
mysql: unsafe chmod/chown use in init script (CPU Jan 2017)
Multiple flaws were found in the way the MySQL init script handled initialization of the database data directory and permission setting on the error log file. The mysql operating system user could use these flaws to escalate their privileges to root...
Cek Tagihan Listrik PLN - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities
HackApp vulnerability scanner discovered that application Cek Tagihan Listrik PLN published at the 'play' market has multiple vulnerabilities...
SQL Injection Vulnerability in Hdwiki 6.0 Frontend
Interactive Wiki open source system HDwiki is by the interactive online Beijing Technology Co., Ltd. launched a free wiki Wiki building system. wiki6.0 'control/ list.php' SQL injection vulnerability exists, the vulnerability stems from the failure to effectively filter user-submitted data, remot...
Hashicorp vagrant-vmware-fusion 4.0.20 - Local Privilege Escalation
Hashicorp vagrant-vmware-fusion 4.0.20 - Local Privilege Escalation I'm a big fan of Hashicorp but this is an awful bug to have in software of their calibre. Their vagrant plugin for vmware fusion uses a product called Ruby Encoder to protect their proprietary ruby code. It does this by turning t...
Corebox - External URLs, SD-card access, Unsafe deleting vulnerabilities
HackApp vulnerability scanner discovered that application Corebox published at the 'play' market has multiple vulnerabilities...
WakaTime: Unsafe Inline and Eval CSP Usage
Hi Team, The HTTP header of the wakatime.com website includes an unsafe CSP parameter for "script-src". Impact: However, the "script-src" parameter is set to "unsafe-inline" or "unsafe-eval", which allows injection of user passed values, which in result can be misused for Cross-Site Scripting...
Google TalkBack - External URLs, Suspicious files, Unsafe deleting vulnerabilities
HackApp vulnerability scanner discovered that application Google TalkBack published at the 'play' market has multiple vulnerabilities...
ansible: Security issue with lookup return not tainting the jinja2 environment
An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the...
Grow Castle - Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Grow Castle published at the 'play' market has multiple vulnerabilities...
Unsafe Signing Using A Broken Entropy Sources
crypto/ecdsa in github.com/golang/go is vulnerable to unsafe signing. It can happen because it uses a signing key generated using a broken entropy of rand...
PECL YAML parser unsafe object handling
More info at https://www.drupal.org/SA-CORE-2017-003...
PECL YAML parser unsafe object handling
More info at https://www.drupal.org/SA-CORE-2017-003...
CVE-2017-3097
Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading functions in the installer plugin. A successful exploitation could lead to arbitrary code execution...
DisplayLink Presenter - Native code usage, Suspicious files, Unsafe deleting vulnerabilities
HackApp vulnerability scanner discovered that application DisplayLink Presenter published at the 'play' market has multiple vulnerabilities...
MGASA-2017-0164 Updated ansible packages fix security vulnerability
It was found that aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key CVE-2016-8614. It is reported that in Ansible, under some circumstances the mysqluser module...
NOVA IPTV PLAYER+ - External URLs, Unsafe deleting, WebView JavaScript enabled vulnerabilities
HackApp vulnerability scanner discovered that application NOVA IPTV PLAYER+ published at the 'play' market has multiple vulnerabilities...
MyHives - SD-card access, Suspicious files, Unsafe deleting vulnerabilities
HackApp vulnerability scanner discovered that application MyHives published at the 'play' market has multiple vulnerabilities...
Pivotal Spring Web Flow Remote Code Execution Vulnerability
Pivotal Spring Web Flow is a web application from Pivotal Software, Inc. that provides navigation for check-in, loan application or shopping cart checkout. A remote code execution vulnerability exists in Pivotal Spring Web Flow versions 2.4.0 through 2.4.4. The vulnerability is caused due to a...