CVE-2018-0337

A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on an affected device. The vulnerability exists because the affected software lacks proper input and validation checks for certain file...

UBUNTU-CVE-2018-12617

qmpguestfileread in qga/commands-posix.c and qga/commands-win32.c in qemu-ga aka QEMU Guest Agent in QEMU 2.12.50 has an integer overflow causing a gmalloc0 call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted Q...

method-override denial of service vulnerability

method-override is a module that enables the use of HTTP Verbs such as PUT, DELETE, etc. in the client. A security vulnerability exists in method-override. An attacker can exploit this vulnerability with specially crafted input to cause a denial of service...

string module denial of service vulnerability

The string module is a lightweight JavaScript library that provides additional String methods for Node.js. A security vulnerability exists in the string module. An attacker can exploit this vulnerability to cause a denial of service with the help of untrustworthy specially crafted input...

Updated poppler packages fix security vulnerability

The updated packages fix security vulnerabilities: The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service infinite recursion via a crafted PDF file, as demonstrated by pdftops. CVE-2017-18267 There is a NULL pointer...

Input validation

An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input...

CVE-2018-9025

An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input...

UBUNTU-CVE-2018-12458

An improper integer type in the mpeg4encodegopheader function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service...

Digium Asterisk Open Source Remote Authentication Session Vulnerability

Digium Asterisk Open Source is an open source telephone exchange PBX system software from Digium. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR and so on. A security vulnerability exists in version 15.x of Digium Asterisk Open Source prior to...

DEBIAN-CVE-2017-16119

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

CVE-2017-16117

slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds...

AZL-44892 CVE-2017-16119 affecting package nodejs-nodemon 2.0.3-5

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

UBUNTU-CVE-2017-16119

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

jadedown denial of service vulnerability

jadedown is a package used in Ndoe.js. A security vulnerability exists in jadedown. An attacker can exploit this vulnerability by passing in certain types of user input to cause a denial of service...

CVE-2018-6662

Privilege Escalation vulnerability in McAfee Management of Native Encryption MNE before 4.1.4 allows local users to gain elevated privileges via a crafted user input...

PT-2018-17702 · Mcafee · Mcafee Management Of Native Encryption

Name of the Vulnerable Software and Affected Versions: McAfee Management of Native Encryption MNE versions prior to 4.1.4 Description: A privilege escalation issue allows local users to gain elevated privileges through crafted user input. Recommendations: For versions prior to 4.1.4, update to...

Espruino Buffer Overflow Vulnerability (CNVD-2018-10888)

Espruino is a JavaScript interpreter for microcontrollers. A buffer overflow vulnerability exists in Espruino prior to 1.99. The vulnerability arises due to the misuse of strncat during syntax parsing. An attacker can exploit this vulnerability via a specially crafted input file to cause a denial...

CVE-2018-11592

Espruino before 1.98 allows attackers to cause a denial of service application crash with a user crafted input file via an Out-of-bounds Read during syntax parsing in which certain height validation is missing in libs/graphics/jswrapgraphics.c...

CVE-2018-11596

Espruino before 1.99 allows attackers to cause a denial of service application crash with a user crafted input file via a Buffer Overflow during syntax parsing because a check for '\0' is made for the wrong array element in jsvar.c...

CVE-2018-11591

Espruino before 1.98 allows attackers to cause a denial of service application crash with a user crafted input file via a NULL pointer dereference during syntax parsing. This was addressed by adding validation for a debug trace print statement in jsvar.c...