CVE-2018-2478

An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the adm user. The commands executed depen...

nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters

It was found that the Buffer.fill and Buffer.alloc function may hang. An attacker able to control the input of these function could use this flaw to cause a denial of service...

Article Factory Manager SQL Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A SQL injection vulnerability exists in the Article Factory Manager component of Joomla! The vulnerability is caused by inserting SQL commands into the query string of a web form...

Fresh Denial of Service Vulnerability

Fresh is a Node.js module that uses request and response headers to detect response freshness. A security vulnerability exists in Fresh. An attacker can exploit the vulnerability with the help of specially crafted inputs to cause a denial of service...

CVE-2017-17889

Kliqqi CMS 3.5.2 is affected by CVE-2017-17889, with cross-site scripting via crafted input in pligg/groups.php (group name), profile Homepage field, or Tags/Description in pligg/submit.php. The vulnerability is documented across multiple sources (NVD/CNVD) and describes XSS that can be triggered...

USN-3547-1 libtasn1-6 vulnerabilities

It was discovered that Libtasn1 incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2017-10790 It was discovered that Libtasn1...

Exiv2 'Image::printIFDStructure' heap buffer overflow vulnerability

Exiv2 is a cross-platform C++ library and command line utility for managing image metadata. The Image::printIFDStructure function in Exiv2's image.cpp suffers from a heap buffer overflow that allows an attacker to conduct a remote denial-of-service attack with specially designed inputs...

CVE-2017-8003

EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of t...

Moxa AWK-3131A Wireless Access Point Cross-Site Scripting Vulnerability

Moxa AWK-3131A Wireless Access Point is a wireless switch from Moxa, China.Web Application is one of the web application modules. A cross-site scripting vulnerability exists in the Web Application feature of the Moxa AWK-3131A Wireless Access Point with firmware version 1.1. A remote attacker can...

Foreman Arbitrary Code Execution Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. A security vulnerability in the smart proxy TFTP API in Foreman versions 1.11.x before 1.10.4 and 1.11.2 before 1.11.2 can be exploited by a remote attacker to execute arbitrary code with the help of specially...

F5 Networks BIG-IP : Perl vulnerabilities (K15867)

CVE-2012-5195 Heap-based buffer overflow in the Perlrepeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service memory consumption and crash or possibly execute arbitrary code via the 'x...

OpenSSL: PKCS7 crash with missing EnvelopedContent

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected ...

openssl: PKCS7 NULL pointer dereference

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected ...

openssl: PKCS7 NULL pointer dereference

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected ...

Qemu: block: multiple integer overflow flaws

Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service crash via a crafted catalog size in 1 the parallelsopen function in block/parallels.c or 2 bochsopen function in bochs.c, a large L1 table in the 3 qcow2snapshotloadtmp i...

Qemu: block: multiple integer overflow flaws

Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service crash via a crafted catalog size in 1 the parallelsopen function in block/parallels.c or 2 bochsopen function in bochs.c, a large L1 table in the 3 qcow2snapshotloadtmp i...

CVE-2013-2002

Buffer overflow in X.org libXt 1.1.3 and earlier allows X servers to cause a denial of service crash and possibly execute arbitrary code via crafted length or index values to the XtResourceConfigurationEH function...

CVE-2013-1997

Multiple buffer overflows in X.org libX11 1.5.99.901 1.6 RC1 and earlier allow X servers to cause a denial of service crash and possibly execute arbitrary code via crafted length or index values to the 1 XAllocColorCells, 2 XkbReadGetDeviceInfoReply, 3 XkbReadGeomShapes, 4 XkbReadGetGeometryReply...

DEBIAN-CVE-2012-3418

libpcp in Performance Co-Pilot PCP before 3.6.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via 1 a PDU with the numcreds field value greater than the number of actual elements to the pmDecodeCreds function in pcreds.c; 2 the string byte number value t...

CVE-2012-4579

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations 1 TRUNCATE or 2 DROP link for a crafted table name, 3 the Add Trigger popup within a Triggers page that references...