4416 matches found
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
CVE-2014-8561
imagemagick 6.8.9.6 has remote DOS via infinite loop...
CVE-2019-13755
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page...
MGASA-2019-0322 Updated python-numpy packages fix security vulnerability
Updated python-numpy packages fix security vulnerability: An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call CVE-2019-6446...
PT-2019-14693 · Yandex +1 · Clickhouse +1
Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 19.14 Description: The issue concerns an out-of-bounds OOB read, OOB write, and integer underflow in decompression algorithms. This can be exploited to achieve remote code execution RCE or cause a denial of servic...
CVE-2019-3731
RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of...
CVE-2019-14994
CVE-2019-14994 affects Atlassian Jira Service Desk Server and Data Center’s Customer Context Filter path traversal vulnerability. Vulnerable versions include Jira Service Desk prior to 3.9.16, 3.10.x before 3.16.8, 4.0.x before 4.1.3, 4.2.x before 4.2.5, 4.3.x before 4.3.4, and 4.4.x before 4.4.1...
CVE-2019-5956
Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors...
Arbitrary Code Execution
pango is vulnerable to arbitrary code execution. A heap-based buffer overflow in the function pangolog2visgetembeddinglevels allows a remote attacker to execute arbitrary code by passing malicious utf-8 strings to the pangoitemize function...
Remote Code Execution (RCE)
microsoft.chakracore is vulnerable to remote code execution RCE. The vulnerability exists due to a chakra type confusion...
Cross-site Request Forgery (CSRF)
jolokia is vulnerable to cross-site request forgery CSRF. The backend manager does not properly handle the strict checking for origin and referrer header, causing a system-wide CSRF which subsequently allows a remote code execution...
PT-2019-18334 · Foxit · Foxit Reader
Name of the Vulnerable Software and Affected Versions: Foxit Reader version 9.4.1.16828 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...
PT-2019-18495 · Linear · Linear Emerge E3-Series
Name of the Vulnerable Software and Affected Versions: Linear eMerge E3-Series devices affected versions not specified Description: The issue allows for Remote Code Execution, providing root access over SSH. Recommendations: At the moment, there is no information about a newer version that contai...
CVE-2019-11580
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits...
CVE-2016-7550
asterisk 13.10.0 is affected by: denial of service issues in asterisk. The impact is: cause a denial of service remote...
CVE-2017-12804
The iwgifinitscreen function in imagew-gif.c:510 in ImageWorsener 1.3.2 allows remote attackers to cause a denial of service hmemory exhaustion via a crafted file...
Out-of-bounds Read
libevent is vulnerable to out-of-bounds reads. A remote attacker could cause denial of service via an out-of-bounds read by forcing the application to resolve an empty hostname. Affected is the function searchmakenew of the file evdns.c...
Memory Corruption
Firefox is vulnerable to memory corruption attacks. A remote user can exploit a flaw in the JIT code allocation allowing a bypass of ASLR and DEP protection. This leads to obtain potentially sensitive information on the target system...
Arbitrary Code Execution
firefox is vulnerable to use-after-free vulnerability. The vulnerability exists in the mozilla::a11y::DocAccessible::ProcessInvalidationList function. Remote attackers can execute arbitrary code via an aria-owns attribute which affects the availability causing a denial of service DOS attacks...