CVE-2023-48257

The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution RCE with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticate...

Design/Logic Flaw

An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG...

GHSA-XP5H-F8JF-RC8Q rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

NOTE: rails-ujs is part of Rails/actionview since 5.1.0. There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML...

SUSE CVE-2023-23913

There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method,...

PT-2023-19296 · Ruby On Rails +1 · Rails-Ujs +1

Name of the Vulnerable Software and Affected Versions: rails-ujs versions 5.1.0 through 6.1.7.2 rails-ujs versions 5.1.0 through 7.0.4.2 Description: There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned...

Qognify Ocularis EventCoordinator ConnectedChannel_GotMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of serialized objects provided to the EventCoordinator endpoint. The issue...

Debian: Security Advisory (DLA-2174-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Deserialization of untrusted data

In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request to invoker/JMXInvokerServlet, aka PSRT110461...

CVE-2014-3462

The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes"...

Ruby on Rails: CSRF header is sent to external websites when using data-remote forms

Looks like there is a regression in the fix for CVE-2015-1840 H1 report. The origin isn't being checked before adding a CSRF header to data-remote forms. I noticed this when checking out the new rails-ujs repo. Example Rails template: submit Example http://attacker.com app require "sinatra" optio...

CVE-2014-0488

CVE-2014-0488 concerns APT before 1.0.9, where the package manager does not properly invalidate repository data when transitioning from unauthenticated to authenticated state. This can allow a remote attacker to influence repository data with unspecified impact. The connected advisories consisten...

CVE-2011-4103

Removed by vendor...

Deserialization of untrusted data

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via a the 1 a1 or 2 a2 parameter in a restart action...

CVE-2008-5246

Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the 1 id3v22interpframe and 2 id3v24interpframe functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are...

ProWizard 4 PC 1.62 - Multiple Remote Stack Buffer Overflow Vulnerabilities

ProWizard 4 PC 1.62 - Multiple Remote Stack Buffer Overflow Vulnerabilities // source: https://www.securityfocus.com/bid/26953/info ProWizard 4 PC is prone to multiple stack-based buffer-overflow issues because it fails to perform adequate boundary checks on user-supplied data. Successfully...

Nullsoft Winamp < 5.0.8c IN_CDDA.dll Library Remote Overflow

Binary data 2563.prm...

[SA12708] Mozilla Firefox Download Directory File Deletion Vulnerability

TITLE: Mozilla Firefox Download Directory File Deletion Vulnerability SECUNIA ADVISORY ID: SA12708 VERIFY ADVISORY: http://secunia.com/advisories/12708/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: Mozilla Firefox 0.x http://secunia.com/product/3256/...

Java (.java / .class) Source Code Disclosure

The remote web server is hosting Java .java and/or .class files. These files may contain sensitive or proprietary information. If so, a remote attacker could use this information to mount further attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Microsoft Internet Explorer - Object Data Remote (MS03-032)

Microsoft Internet Explorer - Object Data Remote MS03-032 by malware M03-032 Exploit self.MoveTo 5000,5000 dim v24 cut="" v0="4D,5A,44,01,05,y,02,y,20,y,21,y,z2,75,y2,02,y2,99,y3,3E,y3,01,y,FB,30,6A,72,y1C,79,y3,9E,...

FoxWeb 2.5 - PATH_INFO Remote Buffer Overrun

source: https://www.securityfocus.com/bid/8547/info FoxWeb is prone to a remotely exploitable buffer overrun vulnerability. This is due to insufficient bounds checking of user-supplied PATHINFO data to the Foxweb CGI and ISAPI extension. Successful exploitation would permit a remote attacker to...