The vulnerability of the embedded software of the programmable logic controller OVEEN PLK110 allows a intruder to trigger buffer overflow attacks.

The vulnerability of the embedded software of the programmable logic controller OVEEN PLK110 is related to incorrect indexing of the input data array. Exploiting this vulnerability can allow an attacker to trigger a buffer overflow service denial by sending a specially crafted network packet whos...

Android ssp_batch_ioctl Out-Of-Bounds Write Exploit

Android suffers from an out-of-bounds write in sspbatchioctl. Android: OOB write in sspbatchioctl SensorHub exposes a character device under /dev/batchio which can be used in order to send instructions to batches of running sensors. The IOCTL handler from this device has the following high-level...

The vulnerability of the Flash Player software, which allows a perpetrator to execute arbitrary code

The vulnerability of the Flash Player software is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by manipulating the length properties of object arrays...

The vulnerability of the Flash Player software, which allows a perpetrator to execute arbitrary code

The vulnerability of the Flash Player software is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by manipulating the length properties of object arrays...

CVE-2016-8441

Possible buffer overflow in the hypervisor. Inappropriate usage of a static array could lead to a buffer overrun. Product: Android. Versions: Kernel 3.18. Android ID: A-31625904. References: QC-CR1027769...

Buffer overflow

Possible buffer overflow in the hypervisor. Inappropriate usage of a static array could lead to a buffer overrun. Product: Android. Versions: Kernel 3.18. Android ID: A-31625904. References: QC-CR1027769...

shopify-scripts: Crash in print_backtrace

This crash does not affect mruby-engine because it does not print the back trace in guest. We can control the register by setting a backtrace array. PoC ruby exc = Exception.new exc.setbacktrace0x41414141 raise exc GDB $ gdb -q --args ./bin/mruby test12.rb Reading symbols from ./bin/mruby...done...

shopify-scripts: Still heap overflow in mrb_ary_splice

The fix of 192362 is still crashed with a different PoC. I think the cause of this bug is the same and I missed the incomplete fix, so you may be able to skip rewards for this one. Cause If I set the tail value to a specific value, then I can maintain the array size. The original fix only checks...

CVE-2017-5340

Zend/zendhash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service integer overflow, uninitialized memory access, and use of arbitrary destructor function...

CVE-2017-5340

Removed by vendor...

CVE-2017-5340

Zend/zendhash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service integer overflow, uninitialized memory access, and use of arbitrary destructor function...

Aerospike Database Server Client Message Memory Disclosure Vulnerability

Summary An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds read resulting in disclosure of memory within the process, the same vulnerability can also be use...

Heap overflow

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "argtypes" allocation is made based on args array length. Specially constructed object passed as element of args array can...

shopify-scripts: Clearing , Shifting and Pop Value from Frozen Array

Hey again! Founded another missing best practice in mruby. That allow an attacker to Delete pop or clear the Frozen ARRAY. This report is similar to 194866 POC === $a = 1,2,3,4,5.freeze $a.pop "= This will give 5 and $a will become 1,2,3,4" $a.shift "= This will give 1 and $a will become 2,3,4,5"...

PT-2017-2445 · Ruby +2 · Ruby +2

Name of the Vulnerable Software and Affected Versions: Ruby affected versions not specified Description: A heap overflow issue exists in the Fiddle::Function.new "initialize" function functionality of Ruby. The heap buffer "arg types" allocation is made based on the args array length. A specially...

ImageMagick SyncExifProfile Out Of Bounds Array Indexing (CVE-2016-7799)

A out-of-bounds array indexing vulnerability exists in ImageMagick. The vulnerability is due to improper handling of certain objects in memory. Successful exploitation could result in arbitrary code execution...

Out-of-bounds

KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service out-of-bounds array access and host OS crash via a crafted interrupt request, related to...

CVE-2016-9777

KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service out-of-bounds array access and host OS crash via a crafted interrupt request, related to...

CVE-2016-9777

KVM in the Linux kernel (before 4.8.12) is vulnerable when I/O APIC is enabled. A guest user can craft an interrupt request to bypass VCPU index restrictions, potentially gaining host privileges or causing a host denial of service via out-of-bounds access and host crash. Affected components: arch...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the Flash Player software is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code upon installation of certain object array length properties...