USN-3527-1: Irssi vulnerabilities

Joseph Bisch discovered that Irssi incorrectly handled incomplete escape codes. If a user were tricked into using malformed commands or opening malformed files, an attacker could use this issue to cause Irssi to crash, resulting in a denial of service. CVE-2018-5205 Joseph Bisch discovered that...

CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

ASP.NET Core Cross Site Request Forgery Vulnerabilty

A Cross Site Request Forgery CSRF vulnerability exists when a ASP.NET Core web application is created using vulnerable project templates. An attacker who successfully exploited this vulnerability could change the recovery codes associated with the victim's user account without his/her consent. As...

FreeBSD : irssi -- multiple vulnerabilities (a3764767-f31e-11e7-95f2-005056925db4)

Irssi reports : When the channel topic is set without specifying a sender, Irssi may dereference NULL pointer. Found by Joseph Bisch. When using incomplete escape codes, Irssi may access data beyond the end of the string. Found by Joseph Bisch. A calculation error in the completion code could cau...

CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

Design/Logic Flaw

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

ALPINE-CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

SonicWall SonicOS NSA - Multiple Web Vulnerabilities

Document Title: =============== SonicWall SonicOS NSA - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1725 Release Date: ============= 2018-01-06 Vulnerability Laboratory ID VL-ID: ==================================== 1725...

UBUNTU-CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

CVE-2013-7400

The Direct Mail directmail extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes...

Automattic: Stored XSS in www.learnboost.com via ZIP codes.

Summary --- www.learnboost.com is vulnerable to stored XSS via ZIP codes stored alongside school names in the Network panel. Browsers Verified In --- Mozilla Firefox 58.0b12 64-bit PoC --- Visit https://www.learnboost.com/settings/network/search and search for fro. My entry will trigger the XSS...

Abusing Windows Security: mimikatz

mimikatz is well known tool for extraction of plaintexts passwords, hashes, PIN codes and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. A lot of times after the initial exploitation phase attackers may want to get a firmer foothold...

CVE-2017-17556

A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan codes by modifying registry keys...

CVE-2017-17556

CVE-2017-17556 affects Synaptics TouchPad drivers (notably the SynTP.sys driver) where a debug tool can be abused by a user with administrative privileges to modify registry keys and capture keyboard scan code information. The root cause is an unprotected debug mode in the Synaptics keyboard driv...

CVE-2017-16363

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the module that handles character codes for...