CVE-2018-3720

The CVE-2018-3720 entry concerns the assign-deep Node.js module. Versions prior to 0.4.7 are affected by a prototype-pollution (MAID) vulnerability that lets an attacker modify Object.prototype via proto , enabling addition or modification of properties that propagate to all objects. Impact is de...

CVE-2018-3720

assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

GNU Binutils Binary File Descriptor Library Denial of Service Vulnerability (CNVD-2018-05200)

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utilities developed by the GNU Project to work with object files in a variety of formats, with connectors, assemblers, and other tools for object files and archives.The Binary File Descriptor BFD library a.k.a...

Prototype Pollution

assign-deep is vulnerable to prototype pollution attacks. Attackers can add or modify existing properties relating to an Object by using the utilities function to change the prototype of said Object. Using this flaw, attackers can trigger denial of service DoS attacks and in some situations remot...

Node.js third-party modules: Prototype pollution attack (assign-deep)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the assign-deep library. Module: assign-deep Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of...

Kingsoft WPS Office Denial of Service Vulnerability

Kingsoft WPS Office is an office software suite from the Chinese company Kingsoft, commonly used components include Writer word processing, Spreadsheets spreadsheets and Presentation presentations. A security vulnerability exists in the 'WStr::assign' function of the kso.dll file in Kingsoft WPS...

CVE-2018-6390

The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of the source memory block before an copy call, which allows remote attackers to cause a denial of service access violation and application crash via a crafted a web page, b office...

Code injection

The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of the source memory block before an copy call, which allows remote attackers to cause a denial of service access violation and application crash via a crafted a web page, b office...

FortiOS < 5.6.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: FortiOS = 5.6.0 Multiple XSS Vulnerabilities Vendor: Fortinet www.fortinet.com CVE: CVE-2017-3131, CVE-2017-3132, CVE-2017-3133 Date: 28.07.2016 Author: Patryk Bogdan @patrykbogdan Affected FortiNet products: CVE-2017-3131 : FortiOS...

FortiOS 5.6.0 - Cross-Site Scripting

FortiOS 5.6.0 - Cross-Site Scripting Title: FortiOS = 5.6.0 Multiple XSS Vulnerabilities Vendor: Fortinet www.fortinet.com CVE: CVE-2017-3131, CVE-2017-3132, CVE-2017-3133 Date: 28.07.2016 Author: Patryk Bogdan @patrykbogdan Affected FortiNet products: CVE-2017-3131 : FortiOS versions 5.4.0 to...

FortiOS 5.6.0 Cross Site Scripting

Title: FortiOS = 5.6.0 Multiple XSS Vulnerabilities Vendor: Fortinet www.fortinet.com CVE: CVE-2017-3131, CVE-2017-3132, CVE-2017-3133 Date: 28.07.2016 Author: Patryk Bogdan @patrykbogdan Affected FortiNet products: CVE-2017-3131 : FortiOS versions 5.4.0 to 5.6.0 CVE-2017-3132 : FortiOS versions...

Assigning a GPU to a Windows VM using xe CLI

To assign a GPU to a Windows VM using xe CLI...

CVE-2016-2157

Cross-site request forgery CSRF vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage...

Internet Bug Bounty: Use after free with assign by ref to overloaded objects

Reported: 2015-07-15 16:30 UTC Fixed: 2015-07-21 14:20 UTC Bug Report: https://bugs.php.net/bug.php?id=70083 Fixed in PHP 5.6: http://git.php.net/?p=php-src.git;a=commitdiff;h=f57cb13c566613eec0e1c2f6d96d18565436a9b7 Fixed in 7:...

CVE-2015-1498

Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to 1 enumerate user accounts via a getUsers request, 2 assign a role to a user account via an addAssigneesToRole request, 3 remove a role from a user account via a...

USAA Mobile App Information Disclosure

The USAA Mobile app for Android, prior to version 7.10.1 released 19 January, contains an information disclosure vulnerability. I have submitted a CVE-Assign request for this issue but do not yet have a CVE assigned. The issue is demonstrated with sanitized screen captures at...

CVE-2014-9388

bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...

CVE-2014-9388

bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...

ARM ifconfig eth0 and Assign Address

No description provided by source. / Title: arm-ifconfig Brief: Bring up eth0 and assign it the address 192.168.0.2 Author: Daniel Godas-Lopez gmail account dgodas / / socdes = socketAFINET, SOCKDGRAM, IPPROTOIP; / mov %r0, $2 / AFINET / mov %r1, $2 / SOCKDGRAM / mov %r2, $0 / IPPRTOTOIP / push...

UBUNTU-CVE-2013-2226

Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the 1 usersidassign parameter to ajax/ticketassigninformation.php, 2 filename parameter to front/document.form.php, or 3 table parameter to ajax/comments.php...