339 matches found
DEBIAN-CVE-2018-17942
The converttodecimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing...
UBUNTU-CVE-2018-17942
The converttodecimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing...
PT-2018-14289
Name of the Vulnerable Software and Affected Versions Gnulib versions prior to 2018-09-23 Description The issue is related to a heap-based buffer overflow in the convert to decimal function, located in the vasnprintf.c file. This overflow occurs because memory is not allocated for a trailing '0'...
DRUPAL-CONTRIB-2018-059
This module enables you to create fields for storing decimal values as two integers numerator and denominator for maximum precision. The module doesn't sufficiently filter XSS strings out of field labels. This vulnerability is mitigated by the fact that an attacker must have a role with the abili...
Fraction - Less critical - XSS vulnerability - SA-CONTRIB-2018-059
This module enables you to create fields for storing decimal values as two integers numerator and denominator for maximum precision. The module doesn't sufficiently filter XSS strings out of field labels. This vulnerability is mitigated by the fact that an attacker must have a role with the abili...
PT-2018-19491
This module enables you to create fields for storing decimal values as two integers numerator and denominator for maximum precision. The module doesn't sufficiently filter XSS strings out of field labels. This vulnerability is mitigated by the fact that an attacker must have a role with the abili...
CVE-2018-14439
espritblock eos4j, an unofficial SDK for EOS, through 2018-07-12 mishandles floating-point numbers with more than four digits after the decimal point, which might allow attackers to trigger currency transfers of unintended amounts...
CVE-2018-5752
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery SSRF attacks via vectors involving non-decimal representations of IP addresses and...
PT-2018-17125
Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev36 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev39 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev44 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev22...
CVE-2018-5752: Server-Side Request Forgery (SSRF)
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery SSRF attacks via vectors involving non-decimal representations of IP addresses and...
gcc security, bug fix, and enhancement update
4.8.5-28.0.1 - Orabug: 27557686 Egeyar Bagcioglu - Introduce 'oraclerelease' into .spec file. Echo it to gcc/DEV-PHASE. 4.8.5-28 - Minor testsuite fixes to clean up test results 1469697 - retpoline support for spectre mitigation 1535655 4.8.5-27 - bump for rebuild with RELRO enabled even for...
Decodify - Detect And Decode Encoded Strings Recursively
Decodify can detect and decode encoded strings, recursively. Its currently in beta phase. Lets take this string : teamultimate.in and encode it with Hex, URL, Base64 and FromChar encoding, respectively. Now lets pass this encoded string to Decodify: Boom! Thats what Decodify does. Supported...
AlienVault : SSRF protection bypass
As said in report 285380, using the decimal IP notation is bypassing the fix : https://www.threatcrowd.org/domain.php?domain=2852039166...
CVE-2017-9624
Multiple cross-site scripting XSS vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data...
CVE-2017-9624
Multiple cross-site scripting XSS vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data...
CVE-2017-9624
Multiple cross-site scripting XSS vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data...
CVE-2017-9624
Multiple cross-site scripting XSS vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data...
CVE-2017-9624: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data...
PT-2017-19083
Name of the Vulnerable Software and Affected Versions Telaxus/EPESI versions 1.8.2 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data, which can lead to cross-site scripting XSS attacks. Recommendations For...
Ubuntu: Security Advisory (USN-3271-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...