Design/Logic Flaw

In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the module K7TSHlpr.dll improperly validates the administrative privileges of the user, allowing arbitrary registry writes in the K7AVOptn.dll...

CVE-2019-16897

In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the module K7TSHlpr.dll improperly validates the administrative privileges of the user, allowing arbitrary registry writes in the K7AVOptn.dll...

CVE-2019-10185

It was found that icedtea-web was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox. Mitigation No kno...

Directory Traversal

Overview iobroker.js-controller is a controller that is owning the central configuration of the ioBroker installation and controls and monitors all adapter processes for the current host. Affected versions of this package are vulnerable to Directory Traversal. An attacker can include file content...

The vulnerability of the ColdFusion software platform, related to errors in restricting the path name of the restricted directory, allows a perpetrator to write any files into the device’s file system.

The vulnerability of the ColdFusion software platform is related to errors in restricting the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system remotely...

Medium: libtiff

Issue Overview: Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service application crash via a crafted GIF file.CVE-2016-3186 An integer overflow has been discovered in libtiff in TIFFSetupStrips:tifwrite.c, which could le...

EulerOS 2.0 SP8 : dovecot (EulerOS-SA-2019-2071)

According to the version of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 and Pigeonhole before 0.5.7.2, protocol processing can fail for quoted strings. This occurs...

CentOS Update for dovecot CESA-2019:2836 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 8 : dovecot (ELSA-2019-2822)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2822 advisory. 1:2.2.36-5.1 - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap...

dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes

A flaw was found in dovecot. IMAP and ManageSieve protocol parsers do not properly handle the NULL byte when scanning data in quoted strings which leads to an out of bounds heap memory write. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

Scientific Linux Security Update : dovecot on SL7.x x86_64 (20190920)

Security Fixes : - dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes CVE-2019-11500 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages list...

RHEL 7 : dovecot (RHSA-2019:2836)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2836 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and...

Remote Code Execution (RCE)

dovecot is vulnerable to remote code execution RCE. The vulnerability exists due to an improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes...

dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes

A flaw was found in dovecot. IMAP and ManageSieve protocol parsers do not properly handle the NULL byte when scanning data in quoted strings which leads to an out of bounds heap memory write. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes

A flaw was found in dovecot. IMAP and ManageSieve protocol parsers do not properly handle the NULL byte when scanning data in quoted strings which leads to an out of bounds heap memory write. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

dovecot security update

1:2.2.36-3.1 - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes 1751383...

The vulnerability of the Dovecot email delivery agent, related to the ability to write beyond the memory boundaries, allows a hacker to execute arbitrary code.

The vulnerability of the Dovecot email delivery agent is related to the possibility of writing beyond the memory boundaries due to incorrect handling of the null-terminator symbol '\0'. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2019-17702 · Twitter · Bower

Name of the Vulnerable Software and Affected Versions: bower versions prior to 1.8.8 Description: The issue allows for a path traversal vulnerability, enabling file write in arbitrary locations via the install command. This occurs because bower does not verify that extracted symbolic links do not...

Microsoft .NET Framework Privilege Vulnerability

Microsoft .NET Framework is a comprehensive and consistent programming model from Microsoft Corporation USA and a development platform. The platform includes the C and Visual Basic programming languages, a public language runtime library, and an extensive class library. A privilege extraction...

py-lmdb buffer overflow vulnerability (CNVD-2019-39377)

py-lmdb is an LMDB an embedded transactional database for Python. A buffer overflow vulnerability exists in py-lmdb version 0.97. An attacker can exploit this vulnerability to cause invalid write operations...