CVE-2018-9358

In gattsprocessattributereq of gattsc.cc, there is a possible read of uninitialized data due to a missing bounds check. This could lead to remote information disclosure in the Bluetooth process with no additional execution privileges needed. User interaction is not needed for exploitation. Produc...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-09135)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. A stored cross-site scripting vulnerability exists in index.php?m=core&f=index in WUZHI CMS 4.1.0, which can be exploited to inject arbitrary web script or HTML via the ontoggle attribute of...

glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service

A flaw was found in glusterfs server which allowed clients to create io-stats dumps on server node. A remote, authenticated attacker could use this flaw to create io-stats dump on a server without any limitation and utilizing all available inodes resulting in remote denial of service...

CVE-2018-18938

CVE-2018-18938 affects WUZHI CMS 4.1.0. There is a stored XSS in the admin-facing page index.php?m=core&f=index, exploitable via an ontoggle attribute in the details/open/ section within a second input field. CVSS metrics in NVD indicate a base score of 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N) under CVSS...

CVE-2018-18927

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the pagelist "attached" attribute which typically has 'class="icon-globe icon-large"' in its value, as demonstrated by an 'UPDATE sysmodule SET attached = "XSS" WHERE id="pagelist"' statement...

CVE-2018-18927

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the pagelist "attached" attribute which typically has 'class="icon-globe icon-large"' in its value, as demonstrated by an 'UPDATE sysmodule SET attached = "XSS" WHERE id="pagelist"' statement...

Design/Logic Flaw

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the pagelist "attached" attribute which typically has 'class="icon-globe icon-large"' in its value, as demonstrated by an 'UPDATE sysmodule SET attached = "XSS" WHERE id="pagelist"' statement...

CVE-2018-18927

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the pagelist "attached" attribute which typically has 'class="icon-globe icon-large"' in its value, as demonstrated by an 'UPDATE sysmodule SET attached = "XSS" WHERE id="pagelist"' statement...

CVE-2018-18909

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

CVE-2018-18909

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

CVE-2018-18909

The CVE-2018-18909 entry applies to xhEditor (version 1.2.2). The underlying issue is a cross-site scripting (XSS) vulnerability: an attacker can inject JavaScript code in the SRC attribute of an IFRAME element within the editor’s source-code view. This is evidenced by multiple connected records ...

CVE-2018-18909

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

DEBIAN-CVE-2018-14660

A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GFMETALOCKKEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs serv...

ALPINE-CVE-2016-2123

A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndrpulldnspname contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndrpulldnspname parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute ov...

glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service

A flaw was found in glusterfs server which allowed clients to create io-stats dumps on server node. A remote, authenticated attacker could use this flaw to create io-stats dump on a server without any limitation and utilizing all available inodes resulting in remote denial of service...

glusterfs: Repeat use of "GF_META_LOCK_KEY" xattr allows for memory exhaustion

A flaw was found in glusterfs server which allowed repeated usage of GFMETALOCKKEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node...

glusterfs: Buffer overflow in "features/locks" translator allows for denial of service

A buffer overflow was found in strncpy of the plgetxattr function. An authenticated attacker could remotely overflow the buffer by sending a buffer of larger length than the size of the key resulting in remote denial of service...

glusterfs: Buffer overflow in "features/locks" translator allows for denial of service

A buffer overflow was found in strncpy of the plgetxattr function. An authenticated attacker could remotely overflow the buffer by sending a buffer of larger length than the size of the key resulting in remote denial of service...

glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service

A flaw was found in glusterfs server which allowed clients to create io-stats dumps on server node. A remote, authenticated attacker could use this flaw to create io-stats dump on a server without any limitation and utilizing all available inodes resulting in remote denial of service...

PT-2018-12649 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions 3.1.2 through 4.1.4 Description: The issue allows a remote, authenticated attacker to perform a denial of service attack by utilizing the GF XATTR IOSTATS DUMP KEY xattr. This can be exploited by mounting a Gluste...