CVE-2018-18585

chmdreadheaders in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character such as the "/\0" name...

Sql injection

ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI...

GHSA-V596-FWHQ-8X48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

GHSA-758M-6G3Q-G3HH Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character - like mytest, test.txt. This can result in unintended behavior...

GHSA-6XH7-4V2W-36Q6 ASP.NET Core fails to properly validate web requests

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and...

ASP.NET Core fails to properly validate web requests

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and...

Git Submodule Arbitrary Code Execution Vulnerability

Git is an open source distributed version control system A security vulnerability in the handling of the '-' character in the Git Submodule allows remote attackers to exploit the vulnerability by submitting a special request that can execute arbitrary code...

DEBIAN-CVE-2018-17456

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character...

Heap overflow

The converttodecimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing...

Apple macOS 10.13.4 - Denial of Service Exploit

Exploit for macOS platform in category dos / poc Exploit Title: Apple MacOS 10.13.4 - Denial of Service PoC Exploit Author: Sriram @SriHxor Vendor Homepage: https://support.apple.com/en-in/HT208848 Tested on: macOS High Sierra 10.13.4, iOS 11.3, tvOS 11.3, watchOS 4.3.0 CVE : CVE-2018-4240 2018 P...

Netis ADSL Router DL4322D RTK 2.1.1 - Denial of Service Exploit

Exploit for hardware platform in category dos / poc Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Denial of Service PoC Author: Cakes Vendor Homepage: http://www.netis-systems.com Software Link: http://www.netis-systems.com/Home/detail/id/74.html Tested Version: RTK 2.1.1 Tested on OS: Kal...

Netis ADSL Router DL4322D RTK 2.1.1 - Denial of Service (PoC)

Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Denial of Service PoC Author: Cakes Discovery Date: 2018-09-16 Vendor Homepage: http://www.netis-systems.com Software Link: http://www.netis-systems.com/Home/detail/id/74.html Tested Version: RTK 2.1.1 Tested on OS: Kali Linux CVE: N/A...

Apple macOS 10.13.4 - Denial of Service (PoC)

Apple macOS 10.13.4 - Denial of Service PoC Exploit Title: Apple MacOS 10.13.4 - Denial of Service PoC Date: 2018-09-10 Exploit Author: Sriram @SriHxor Vendor Homepage: https://support.apple.com/en-in/HT208848 Tested on: macOS High Sierra 10.13.4, iOS 11.3, tvOS 11.3, watchOS 4.3.0 CVE :...

Apple macOS 10.13.4 Denial Of Service

Exploit Title: Apple MacOS 10.13.4 - Denial of Service PoC Date: 2019-09-10 Exploit Author: Sriram @SriHxor Vendor Homepage: https://support.apple.com/en-in/HT208848 Tested on: macOS High Sierra 10.13.4, iOS 11.3, tvOS 11.3, watchOS 4.3.0 CVE : CVE-2018-4240 2018 POC :...

Libpango 1.40.8 - Denial of Service (PoC)

Libpango 1.40.8 - Denial of Service PoC Exploit Title: Libpango 1.40.8 - Denial of Service PoC Date: 2018-08-06 Exploit Author: Jeffery M Vendor Homepage: https://www.pango.org/ Software Link: http://ftp.gnome.org/pub/GNOME/sources/pango/1.40/pango-1.40.9.tar.xz Version: 1.40.8+ Tested on: Window...

Google Chrome < 59.0.3071.115 Character Sanitization Vulnerability

Binary data 700343.pasl...

curl: Invalid URL parsing with '#'

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

Ruby on Rails: Validation bypass for queries generated for PostgreSQL

When using DB for PostgreSQL, I discovered that if a parameter of a query contains null character, there is a pattern in which subsequent strings are lost. how to reproduce Prepare the environment $ rails new postgresqlrails -TB --database=postgresql $ cd postgresqlrails $ bundle exec ruby -v rub...

Heap Overflow

libxcursor.so is vulnerable to heap overflows. The library doesn't properly terminate the null character in strings, causing a one-byte heap overflow that can crash the application or execute arbitrary code...

FreeBSD : py-bleach -- unsanitized character entities (e97a8852-32dd-4291-ba4d-92711daff056)

bleach developer reports : Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized. This security issue was...