CVE-2018-18689

The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected...

PT-2021-8830 · Wondershare +6 · Pdfelement6 Pro +10

Name of the Vulnerable Software and Affected Versions: Foxit Reader versions prior to 9.4 PhantomPDF versions prior to 8.3.9 and 9.x prior to 9.4 eXpert PDF 12 Ultimate affected versions not specified Expert PDF Reader affected versions not specified Nitro Pro affected versions not specified Nitr...

Unspecified Vulnerability in Mozilla Rust

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in flatbuffers crate in versions of Mozilla Rust prior to 0.6.1, which stems from the fact that an arbitrary byte can be reinterpreted as a bool.No details of the vulnerability ar...

Buffer overflow

The iconv feature in the GNU C Library aka glibc or libc6 through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read...

UBUNTU-CVE-2019-25013

The iconv feature in the GNU C Library aka glibc or libc6 through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read...

CVE-2019-25013

CVE-2019-25013 affects the GNU C Library (glibc) iconv, where processing invalid multi-byte input in EUC-KR can cause a buffer over-read. Connected advisories confirm the issue and map it to glibc versions affected (through 2.32) and note that Debian, AlmaLinux/Alma or Amazon Linux advisories add...

CVE-2020-29363

An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CKATTRIBUTE, the receiving entity may not...

CVE-2020-29363

An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CKATTRIBUTE, the receiving entity may not...

jetty: double release of resource can lead to information disclosure

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this doub...

PT-2020-6233 · P11 Kit +8 · P11-Kit +8

Name of the Vulnerable Software and Affected Versions: p11-kit versions 0.21.1 through 0.23.21 Description: A heap-based buffer over-read has been discovered in the RPC protocol used by the p11-kit server/remote commands and the client library. When the remote entity supplies a byte array through...

CVE-2020-29363

An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CKATTRIBUTE, the receiving entity may not...

Denial Of Service (DoS)

p11-kit is vulnerable to denial of service DoS. The vulnerability exists through a heap-based buffer over-read has been discovered in the RPC protocol used by the p11-kit server/remote commands and the client library in versions 0.21.1 up to 0.23.21. When the remote entity supplies a byte array...

CVE-2020-25110

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The length byte of a domain name in a DNS query/response is not checked, and is used for internal memory operations. This may lead to successful Denial-of-Service, and possibly Remote Code Execution...

Information Disclosure

PHP is vulnerable to Information Disclosure. Reading past the allocated buffer is possible when using certain mbstring functions to convert multi-byte encodings...

php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access...

golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

A flaw was found in the Go encoding/binary package. Certain invalid inputs to the ReadUvarint or the ReadVarint causes those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This flaw possibly leads to processing more input than expected. The...

Alternatives to Animated GIFs

We have all been amused by animated GIFs on lots of websites -- dancing babies, cute cats, flying birds, funny memes, and countless others. Despite their popularity, animated GIFs can be very heavy and can contribute significantly to page performance issues. How significantly? We have seen...

Mozilla: DoH did not filter IPv4 mapped IP Addresses

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding...

Logitech: One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.com

Summary Hello Team I have found a bypass to the this report. 1039749 Steps To Reproduce: 1. Login to attacker's account and go to settings -- account settings. 2. Intercept the request in burp suite and click on merge twitch account. 3. Allow twitch access and once you see a get request in burp...

PT-2020-5853 · P11 Kit +7 · P11-Kit +7

Name of the Vulnerable Software and Affected Versions: p11-kit versions 0.23.6 through 0.23.21 Description: A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array i...