8903 matches found
Unitrends Enterprise Backup File Upload Vulnerability
Unitrends Enterprise Backup is backup software that incorporates cloud continuity services to ensure the recovery of your virtual, physical and cloud data, systems and applications. A file upload vulnerability exists in the createReportName and saveReport functions in Unitrends Enterprise Backup'...
Apple WebKit Safari 10.0.2(12602.3.12.0.1) - PrototypeMap::createEmptyStructure Universal Cross-Site Scripting
Apple WebKit Safari 10.0.212602.3.12.0.1 - PrototypeMap::createEmptyStructure Universal Cross-Site Scripting jsCallee // newTarget may be an InternalFunction if we were called from Reflect.construct. JSFunction targetFunction = jsDynamicCastnewTarget; if LIKELYtargetFunction ... return...
Apple WebKit: UXSS via PrototypeMap::createEmptyStructure
When creating an object in Javascript, its |Structure| is created with the constructor's prototype's |VM|. Here's some snippets of that routine. Structure InternalFunction::createSubclassStructureExecState exec, JSValue newTarget, Structure baseClass ... if newTarget && newTarget != exec-jsCallee...
QEMU 'hw/9pfs/9p.c' has multiple denial of service vulnerabilities
QEMU is an open source emulator software. QEMU suffers from a denial of service vulnerability in the v9fscreate, v9fslcreate functions in hw/9pfs/9p.c, which allows a local attacker to exploit the vulnerability by submitting a special request to crash the application...
DEBIAN-CVE-2017-7377
The 1 v9fscreate and 2 v9fslcreate functions in hw/9pfs/9p.c in QEMU aka Quick Emulator allow local guest OS privileged users to cause a denial of service file descriptor or memory consumption via vectors related to an already in-use fid...
UBUNTU-CVE-2017-7377
The 1 v9fscreate and 2 v9fslcreate functions in hw/9pfs/9p.c in QEMU aka Quick Emulator allow local guest OS privileged users to cause a denial of service file descriptor or memory consumption via vectors related to an already in-use fid...
Fedora 25 : xen (2017-054729ab08)
Qemu: 9pfs: host memory leakage via v9fscreate CVE-2017-7377 1437873 x86: broken check in memoryexchange permits PV guest breakout XSA-212, CVE-2017-7228 1438804 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenabl...
PT-2017-17688
Name of the Vulnerable Software and Affected Versions QEMU aka Quick Emulator versions prior to the fixed version Description The issue allows local guest OS privileged users to cause a denial of service, specifically file descriptor or memory consumption, via certain vectors related to an alread...
Apple WebKit - FormSubmission::create Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function go object.name = "foo"; input.autofocus = true; output.appendChildinput; form.submit; function eventhandler forvar i=0;i a !-- ================================================================= Preliminary analysis: The bug is in...
WebKit: use-after-free in FormSubmission::create (CVE-2017-2460)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. Please note: This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available...
Apple WebKit - 'FormSubmission::create' Use-After-Free
function go object.name = "foo"; input.autofocus = true; output.appendChildinput; form.submit; function eventhandler forvar i=0;i a !-- ================================================================= Preliminary analysis: The bug is in FormSubmission::create. This function traverses the vector ...
Helpful SR CLI commands
Probe the SR: xe sr-probe type=lvmohba device-config:device=/dev/disk/by-id/scsi- xe sr-probe type=lvmoiscsi device-config:target= device-config:targetIQN= xe sr-probe type=nfs device-config:server= device-config:serverpath=/path/to/export Introduce the existing SR to XenServer: xe sr-introduce...
PT-2017-10107
Name of the Vulnerable Software and Affected Versions JasPer versions prior to 1.900.14 Description The issue allows remote attackers to cause a denial of service via a crafted image file, specifically through the jas seq2d create function in jas seq.c. Recommendations For versions prior to...
PT-2017-10111
Name of the Vulnerable Software and Affected Versions JasPer versions prior to 1.900.17 Description The issue allows remote attackers to cause a denial of service via a crafted file. This is due to a problem in the jas seq2d create function in jas seq.c. Recommendations For versions prior to...
Mozilla: integer overflow in createImageBitmap() (MFSA 2017-08)
A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...
FTP Voyager Scheduler Cross-Site Request Forgery Vulnerability
FTP Voyager Scheduler is a program that starts or stops the scheduler when a user creates a directory or uploads or downloads a file by creating a task or command. A cross-site request forgery vulnerability exists in FTP Voyager Scheduler that stems from a failure to properly validate HTTP...
UBUNTU-CVE-2017-6355
Integer overflow in the vrendcreateshader function in vrendrenderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service process crash via crafted pktlength and offlen values, which trigger an out-of-bounds access...
PT-2017-17018
Name of the Vulnerable Software and Affected Versions virglrenderer versions prior to 0.6.0 Description The issue is caused by an integer overflow in the vrend create shader function, which can be triggered by local guest OS users via crafted pkt length and offlen values. This results in an...
UBUNTU-CVE-2016-8863
Heap-based buffer overflow in the createurllist function in gena/genadevice.c in Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an...
