PT-2018-9385 · Dave Gamble · Cjson

Name of the Vulnerable Software and Affected Versions: cJSON versions 1.7.3 and earlier Description: The issue is related to a Use After Free problem in the cJSON library, which can lead to a crash, data corruption, or even Remote Code Execution RCE. The exploitability depends on how the...

GHSA-5MJW-6JRH-HVFQ Sandbox Breakout / Arbitrary Code Execution in static-eval

Affected versions of static-eval pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept js var evaluate = require'static-eval'; var parse = require'esprima'.parse; va...

GHSA-CQP5-M4PQ-GFGP Prototype Pollution in defaults-deep

Versions of default-deep before 0.2.4 are vulnerable to prototype pollution Recommendation Update to version 0.2.4 or later...

Path Traversal in angular-http-server

Affected versions of angular-http-server are vulnerable to path traversal allowing a remote attacker to read files from the server that uses angular-http-server. Recommendation Update to version 1.6.0 or later. :exclamation: Note: This was originally thought to be fixed in version 1.4.3, though...

GHSA-9QJ9-36JM-PRPV Regular Expression Denial of Service in fresh

Affected versions of fresh are vulnerable to regular expression denial of service when parsing specially crafted user input. Recommendation Update to version 0.5.2 or later...

Remote Code Execution in pg

Affected versions of pg contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. There are two specific scenarios in which it is likely for an application to be vulnerable: 1. The application executes unsafe, user-supplied sql...

Invalid Curve Attack in node-jose

Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES is used. Proof of Concept Recommendation Update to version 0.9.3 or later...

PT-2018-12322 · WordPress · Geo Mashup

Name of the Vulnerable Software and Affected Versions: Geo Mashup plugin versions prior to 1.10.4 Description: The issue is related to insufficient sanitization of user input, including post editor input. This could potentially lead to security issues, but specific details about exploitation or...

GHSA-RC8H-3FV6-PXV8 Denial of Service in hapi

Versions of hapi prior to 11.1.3 are affected by a denial of service vulnerability. The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers. This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500 error back...

Path Traversal

Overview Versions of html-pages before 2.1.0 are vulnerable to path traversal. Recommendation Update to version 2.1.0 or later. References - HackerOne Report - GitHub Advisory...

Command Injection

Overview Versions of pdfinfojs before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the pdfinfojs constructor. Recommendation Update to version 0.4.1 or later. References - HackerOne Report - Commit 5cc59cd -...

Hardcoded credentials

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed...

Stack overflow

Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can introduce a value larger than is readable by PMSoft's fixed-length stack buffer. This can cause the buffer to be overwritten, which may allow arbitrary code execution or cause the...

CVE-2018-8839

Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can introduce a value larger than is readable by PMSoft's fixed-length stack buffer. This can cause the buffer to be overwritten, which may allow arbitrary code execution or cause the...

Memory Exposure

Overview Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write Versions 1.3.0 are not affected due to not using unguarded Buffer constructor. Recommendation Update to version 1.5.2, 1.4.11, 1.3.2 or later. If you are unable to update...

Path Traversal

Overview Versions of node-srv before 2.1.1 are vulnerable to path traversal allowing a remote attacker to read files from the server that uses node-srv. Recommendation Update to version 2.1.1 or later. References - HackerOne Report - GitHub Advisory...

PT-2018-15807 · Oracle +5 · Java Se +7

Name of the Vulnerable Software and Affected Versions: Java SE versions 6u181, 7u171, 8u162, 10 Java SE Embedded version 8u161 Description: A difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded...

PT-2018-16624 · Adobe +2 · Flash Player +2

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 28.0.0.161 and earlier Description: The issue is related to a use-after-free vulnerability that could lead to arbitrary code execution in the context of the current user. This vulnerability allows attackers to...

PT-2018-1057 · Exim +3 · Exim +3

Name of the Vulnerable Software and Affected Versions: Exim versions prior to 4.90.1 Description: An issue in the base64d function in the SMTP listener of Exim can cause a buffer overflow when processing handcrafted messages. This can be exploited to execute code remotely. The vulnerability is...

PT-2018-6611 · Illid · Illid Share This Image

Name of the Vulnerable Software and Affected Versions: ILLID Share This Image plugin versions prior to 1.04 Description: The issue concerns a cross-site scripting XSS flaw. It is exploited via the sharer.php url parameter. Recommendations: For versions prior to 1.04, update to version 1.04 or lat...