Buffer overflow

An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bchttpreadheader incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud serve...

Webroot BrightCloud SDK Buffer Overflow Vulnerability

Webroot BrightCloud SDK is a set of SDKs Software Development Kits from Webroot, Inc. for detecting website security. A buffer overflow vulnerability exists in the HTTP header parsing function in the Webroot BrightCloud SDK, which stems from the 'bchttpreadheader' function failing to correctly...

Webroot BrightCloud SDK Information Disclosure Vulnerability

Webroot BrightCloud SDK is a set of SDKs Software Development Kits from Webroot, Inc. for detecting website security. A security vulnerability exists in the HTTP client functionality in the Webroot BrightCloud SDK, which stems from the client configuration failing to make a secure connection by...

CVE-2018-4015

An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightCloud server...

Design/Logic Flaw

An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightCloud server...

CVE-2018-4015

An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightCloud server...

CVE-2018-4015

CVE-2018-4015 affects the Webroot BrightCloud SDK used in CUJO Smart Firewall. The root cause is that the HTTP client defaults to HTTP and does not enforce secure TLS verification, enabling a man-in-the-middle to impersonate BrightCloud servers and potentially expose credentials, alter queries, o...

Webroot BrightCloud SDK HTTP headers-parsing code execution vulnerability

Summary An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bchttpreadheader incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightClo...

Webroot BrightCloud SDK HTTP connection unsafe defaults vulnerability

Summary An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightClou...

CVE-2018-16962

Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges...

CVE-2018-16962

Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges...

Design/Logic Flaw

Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges...

CVE-2018-16962

CVE-2018-16962 affects Webroot SecureAnywhere on macOS prior to 9.0.8.34. The vulnerability arises from mishandling access to the product’s driver by a process that does not have root privileges, indicating a local privilege escalation risk through kernel-level access control weakness. Affected v...

CVE-2018-16962

Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

CVE-2017-16802

In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added...

Design/Logic Flaw

In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added...

CVE-2017-16660

Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remoteagent.php request containing PHP code in a Client-ip header...

CVE-2017-15216

MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...

CVE-2017-15216

MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...