Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. A command injection vulnerability exists in Cisco Enterprise NFV...

Mozilla Firefox ESR Security Advisories (MFSA2019-04, MFSA2019-05) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications...

CVE-2018-16490

A prototype pollution vulnerability was found in module mpath 0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype...

CVE-2018-16489

A prototype pollution vulnerability was found in just-extend 4.0.0 that allows attack to inject properties onto Object.prototype through its functions...

AZL-70997 CVE-2018-19827 affecting package reaper for versions less than 3.1.1-21

In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp or SharedPtr.hpp that may cause a denial of service application crash or possibly have unspecified other impact...

Design/Logic Flaw

embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

AZL-7277 CVE-2018-10393 affecting package libvorbis for versions less than 1.3.7-1

barknoisehybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read...

FreeXL heap buffer out-of-bounds read vulnerability (CNVD-2018-05154)

FreeXL is an open source library for extracting valid data from Excel .xls spreadsheets developed by software developer Alessandro Furieri. A heap buffer out-of-bounds read vulnerability exists in the 'parseSST' function in versions of FreeXL prior to 1.0.5. An attacker can exploit this...

Suricata HTTP Inspection Bypass Vulnerability

Suricata is a set of network intrusion detection system IDS, intrusion prevention system IPS and network security monitoring engine developed by the Open Information Security Foundation OISF and its supported vendors, which supports multi-threading, built-in IPv6, and the ability to load...

CVE-2018-4837

A vulnerability has been identified in TeleControl Server Basic V3.1. An attacker with access to the TeleControl Server Basic's webserver port 80/tcp or 443/tcp could cause a Denial-of-Service condition on the web server. The remaining functionality of the TeleControl Server Basic is not affected...

Mozilla: Use-after-free while editing form elements (MFSA 2018-03)

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 52.6 and Thunderbird 52.6...

Symantec Endpoint Encryption Denial of Service Vulnerability (CNVD-2017-36540)

Symantec Endpoint Encryption SEE is a suite of software from Symantec Corporation that provides advanced encryption and management capabilities for desktops, laptops, and removable storage devices. A security vulnerability exists in Symantec Endpoint Encryption in versions prior to SEE 11.1.3MP1...

Mozilla: Use-after-free during docshell reloading (MFSA 2017-16)

A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...

AZL-45132 CVE-2016-9840 affecting package fltk for versions less than 1.3.8-1

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic...

AZL-44631 CVE-2016-9842 affecting package fltk for versions less than 1.3.8-1

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers...

Google Chrome Blink Cross-Site Scripting Vulnerability (CNVD-2016-12105)

Google Chrome is a web browser developed by Google Inc. Blink is a browser layout engine rendering engine jointly developed by Google Inc. and Opera Software of Norway. A cross-site scripting vulnerability exists in Blink in versions of Google Chrome prior to 55.0.2883.75. An attacker can exploit...

Symantec Norton Mobile Security for Android Security Bypass Vulnerability

Symantec Norton Mobile Security for Android is the United States Symantec Symantec, Inc. based on the Android platform for mobile devices to provide security features of the software. A security bypass vulnerability exists in versions of Symantec Norton Mobile Security for Android prior to 3.16. ...

Kerio Control Cross-Site Request Forgery Vulnerability

Kerio Control is a simple and fast unified threat management system. Cross-site request forgery vulnerabilities in Kerio Control version 9.1.3 can be exploited by an attacker to execute arbitrary script code in the context of an affected site, steal cookie-based authentication, disclose sensitive...

Fortinet FortiSwitch Weak Password Vulnerability

Fortinet FortiSwitch is a suite of secure switching platforms from Fortinet, Inc. designed for Ethernet infrastructure and current network edge configurations. A weak password vulnerability exists in Fortinet FortiSwitch versions prior to 3.4.1. An attacker could exploit the vulnerability to log ...