GHSA-RVJ9-8CVX-3VQ9 Invalid Curve Attack in node-jose

Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES is used. Proof of Concept Recommendation Update to version 0.9.3 or later...

PT-2018-2348

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.9 Description The issue is related to a NULL pointer dereference vulnerability in the xpath.c:xmlXPathCompOpEval function of libxml2. This vulnerability can be exploited by a remote attacker, allowing them to caus...

PT-2018-2075 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: An issue exists due to inadequate protection of the web page structure, allowing a remote attacker to inject arbitrary code into a loaded web page. The username...

PT-2018-10421 · Upx Team +2 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX version 3.95 Description: The issue allows remote attackers to cause a denial of service, limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file. This is...

PT-2018-5363 · Sdl +2 · Sdl2 Image +2

Name of the Vulnerable Software and Affected Versions: SDL2 image version 2.0.2 Description: A code execution issue exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a heap overflow, resulting in code execution. An attacker can trigger this issue by...

PT-2018-4061 · Elinks +2 · Elinks +2

Name of the Vulnerable Software and Affected Versions: ELinks version 0.12 Twibright Links version 2.3 Description: The issue is related to missing SSL certificate validation. Recommendations: For ELinks version 0.12, update to a version that includes proper SSL certificate validation. For...

PT-2018-17140 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 2017 Plus SP1 17.1.1 Description: An issue was discovered that allows remote clients to take advantage of a misconfiguration in the TFTP server, potentially enabling attackers to execute arbitrary...

PT-2025-32250

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 139.0.7258.66 Description A lack of proper validation of untrusted input within the Core component of Google Chrome permitted a remote attacker to manipulate the Omnibox URL bar display through a specially craft...

PT-2017-2990 · Cisco · Cisco Ios

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software versions 12.2 through 15.6 Description: A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol PN-DCP exists due to improper parsing of ingress PN-DCP Identify Request packets. This could...

PYSEC-2017-147

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the loc...

KLA11094 Multiple vulnerabilities in Wireshark

Multiple serious vulnerabilities have been found in Wireshark. Malicious users can exploit these vulnerabilities to cause a denial of service. Below is a complete list of vulnerabilities: 1. Buffer overflow vulnerability in the IrCOMM dissector can be exploited remotely via a specially designed...

PT-2017-18385 · Microsoft · Sql Server Analysis Services +1

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server Analysis Services versions 2012 through 2016 Description: An information disclosure issue exists due to improper permission enforcement. If an attacker's credentials allow access to an affected SQL server database, they...

PT-2018-1896 · Openssh +5 · Openssh +5

Name of the Vulnerable Software and Affected Versions: OpenSSH versions prior to 7.4 Description: The issue is related to a denial of service caused by a NULL pointer dereference and daemon crash in OpenSSH. This can be triggered by remote attackers via an out-of-sequence NEWKEYS message, as...

PT-2017-15246 · WordPress · Wp Live Chat Support

Name of the Vulnerable Software and Affected Versions: WP Live Chat Support versions prior to 7.0.07 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations: For versions prior to 7.0.07, update to version 7.0.07 or later to resolv...

PT-2017-10693 · Nextcloud · Nextcloud Server

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 11.0.3 Description: The issue is related to improper session handling, which allows an application-specific password to access user files without permission. This affects the security of file access for user...

PT-2017-17840 · Red Hat +3 · Elfutils +3

Name of the Vulnerable Software and Affected Versions: elfutils version 0.168 Description: The issue is related to the elf compress.c file in elfutils, which does not validate the zlib compression factor. This allows remote attackers to cause a denial of service, specifically memory consumption, ...

PT-2017-17842 · Red Hat +3 · Elfutils +3

Name of the Vulnerable Software and Affected Versions: elfutils version 0.168 Description: The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via a crafted ELF file. This is due to a problem in the check sysv hash...

PT-2017-16872 · Apache · Mod Auth Openidc

Name of the Vulnerable Software and Affected Versions: mod auth openidc versions prior to 2.1.5 Description: The issue allows remote attackers to bypass authentication via crafted HTTP traffic due to the module not skipping OIDC CLAIM and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass"...

PT-2017-16438 · Icoutils +5 · Icoutils +5

Name of the Vulnerable Software and Affected Versions: icoutils versions prior to 0.31.1 Description: The issue is related to an integer overflow in the extract group icon cursor resource function. This allows local users to cause a denial of service, such as a process crash, or potentially execu...

PT-2017-1118 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 24.0.0.186 and earlier Description: The issue is related to a heap overflow when parsing Adobe Texture Format files, which could lead to arbitrary code execution. This is caused by a buffer overflow in memory,...