PT-2019-9130 · Gnu · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 versions prior to 5.3.1.6 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML in specific files, namely adm/boardgroup form...

PT-2019-5442 · Adobe +1 · Flash Player +1

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 32.0.0.156 and earlier Description: The issue is related to a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution, allowing a remote attacker to bypass security restrictions...

PT-2019-17847 · Overit · Overit Geocall

Name of the Vulnerable Software and Affected Versions: OverIT Geocall versions prior to 6.3 build 2:346977 Description: A directory traversal issue was discovered in the log-management component. Recommendations: For OverIT Geocall versions prior to 6.3 build 2:346977, update to a version that...

KinagaCMS vulnerable to cross-site scripting

Overview KinagaCMS is an opensource Contents Management System CMS. KinagaCMS uses the old version of Bootstrap thus inherits multiple cross-site scripting vulnerabilities CWE-79: CVE-2018-14040, CVE-2018-14041, CVE-2019-8331 existed in Bootstrap. Project Kinaga reported this vulnerability to IPA...

Denial of Service in mqtt-packet

Versions of mqtt-packet prior to 3.4.6, or 4.x prior to 4.0.5 are affected by a denial of service vulnerability wherein specific sequences of MQTT packets can crash the application. Recommendation Version 3.x: Update to version 3.4.6 or later. Version 4.x: Update to version 4.0.5 or later...

PT-2019-19010 · Hdf +3 · Hdf5 +3

Name of the Vulnerable Software and Affected Versions: HDF5 versions prior to 1.10.5 Description: A buffer overflow issue in the HDF5 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file. Recommendations: For versions...

GHSA-H466-J336-74WX Prototype Pollution in mpath

Versions of mpath before 0.5.1 are vulnerable to prototype pollution. Provided certain input mpath can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation Update to version 0.5.1 or later...

Command Injection in apex-publish-static-files

Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later...

PT-2018-13438 · Wago · Wago 750-88X +1

Name of the Vulnerable Software and Affected Versions: WAGO 750-88X and WAGO 750-89X Ethernet Controller devices versions 01.09.1813 and before Description: The issue concerns a cross-site scripting XSS flaw in the SNMP configuration of the affected devices. This flaw can be exploited via the...

PT-2018-9383 · Dave Gamble · Cjson

Name of the Vulnerable Software and Affected Versions: cJSON versions 1.7.6 and earlier Description: The issue in the cJSON library can result in Denial of Service DoS and potentially force a memory leak if the system is in low memory and the attacker can force the data to be printed...

PT-2018-3392 · None +4 · Zziplib +4

Name of the Vulnerable Software and Affected Versions: ZZIPlib versions prior to 0.13.70 Description: The issue is related to a memory leak in the zzip parse root directory function, which can lead to a denial of service attack. This is caused by a resource not being released after its valid...

GHSA-3V6H-HQM4-2RG6 Arbitrary File Write in adm-zip

Versions of adm-zip before 0.4.9 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames ../../file.txt for example. Recommendation Update to version 0.4.9 or later...

GHSA-RVJ9-8CVX-3VQ9 Invalid Curve Attack in node-jose

Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES is used. Proof of Concept Recommendation Update to version 0.9.3 or later...

PT-2018-2348

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.9 Description The issue is related to a NULL pointer dereference vulnerability in the xpath.c:xmlXPathCompOpEval function of libxml2. This vulnerability can be exploited by a remote attacker, allowing them to caus...

PT-2018-2075 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: An issue exists due to inadequate protection of the web page structure, allowing a remote attacker to inject arbitrary code into a loaded web page. The username...

PT-2018-10421 · Upx Team +2 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX version 3.95 Description: The issue allows remote attackers to cause a denial of service, limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file. This is...

PT-2018-5363 · Sdl +2 · Sdl2 Image +2

Name of the Vulnerable Software and Affected Versions: SDL2 image version 2.0.2 Description: A code execution issue exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a heap overflow, resulting in code execution. An attacker can trigger this issue by...

PT-2018-4061 · Elinks +2 · Elinks +2

Name of the Vulnerable Software and Affected Versions: ELinks version 0.12 Twibright Links version 2.3 Description: The issue is related to missing SSL certificate validation. Recommendations: For ELinks version 0.12, update to a version that includes proper SSL certificate validation. For...

PT-2018-17140 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 2017 Plus SP1 17.1.1 Description: An issue was discovered that allows remote clients to take advantage of a misconfiguration in the TFTP server, potentially enabling attackers to execute arbitrary...

PT-2025-32250

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 139.0.7258.66 Description A lack of proper validation of untrusted input within the Core component of Google Chrome permitted a remote attacker to manipulate the Omnibox URL bar display through a specially craft...