PYSEC-2019-115

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting...

Arbitrary Code Execution

java-1.7.1-ibm is vulnerable to arbitrary code execution attacks. The vulnerability exists as inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic...

Denial Of Service (DoS)

perl is vulnerable to denial of service DoS attacks. The vulnerability exists through a heap-based buffer overflow in the Perlrepeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service...

Authentication Bypass

postgresql is vulnerable to authentication bypass attacks. The vulnerability exists as the cryptdes aka DES-based crypt function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80...

burp-ui (>=0.4.1 <=0.5.1), certbot-pinned (=0.17.0) +82 more potentially affected by CVE-2018-1000808 via pyopenssl (>=16.0.0 <=17.4.0)

pyopenssl PYPI version =16.0.0, =0.4.1, =1.2.1.20160901, =0.9.5, =0.2.10.3, =2.2.0, =0.5.0, =0.3.0, =0.2.4, =0.9.2, =0.9.7, =1.9.5, =1.1.1, =1.3.0 and more Source cves: CVE-2018-1000808 Source advisory: OSV:PYSEC-2018-24...

cloudxns-ddns-service (=1.0.0), coderedcms (>=0.10.0 <=0.14.1) +97 more potentially affected by CVE-2018-16984 via django (>=2.1.0 <=2.1.15)

django PYPI version =2.1.0, =0.10.0, =2.4.0, =0.3.1, =0.1.6, =0.2.0, =1.3.2, =0.1.0, =0.1.0a3 - django-basicauth =0.5.1 - django-brunch =1.0.3 and more Source cves: CVE-2018-16984 Source advisory: OSV:PYSEC-2018-3...

Credit Freezes are Free: Let the Ice Age Begin

It is now free in every U.S. state to freeze and unfreeze your credit file and that of your dependents, a process that blocks identity thieves and others from looking at private details in your consumer credit history. If you've been holding out because you're not particularly worried about ID...

ahserver (>=1.0.1 <=1.2.0), aiohttp-admin (>=0.1.0a0 <=0.1.0a3) +62 more potentially affected by CVE-2018-1000519 via aiohttp-session (>=0.8.0 <=2.1.0)

aiohttp-session PYPI version =0.8.0, =1.0.1, =0.1.0a0, =1.0.0, =0.0.1, =1.4.0, =0.3.0, =0.4.3, =0.0.1, =0.1.0, =1.0.0, =0.0.1, =22.3.0, =0.0.1, =0.0.2 and more Source cves: CVE-2018-1000519 Source advisory: OSV:GHSA-FPWP-69XV-C67F...

Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities

Binary data 700332.prm...

Mozilla Firefox ESR < 52.9 Multiple Vulnerabilities

Binary data 700339.prm...

Mozilla Firefox < 57 Multiple Vulnerabilities

Binary data 700322.prm...

Mozilla Firefox < 57.0.1 Multiple Vulnerabilities

Binary data 700323.prm...

Moderate severity vulnerability that affects safemode

Withdrawn, accidental duplicate publish. The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method...

Denial-of-Service (DoS)

libxml2.so is vulnerable to heap-based buffer overflow. The xmlParseXmlDecl function in parser.c allows context-dependent attackers to cause a denial of service condition when an encoding conversion failure occurs which causes the parser to extract more errors during the failure...

bubble (>=2016.3.17 <=2016.8.16), cryptocmd (>=0.5.1 <=0.5.2) +1 more potentially affected by CVE-2017-2810 via tablib (>=0.11.2 <=0.11.4)

tablib PYPI version =0.11.2, =2016.3.17, =0.5.1, =0.1.1, =0.2.3 Source cves: CVE-2017-2810 Source advisory: OSV:GHSA-GCR6-RF47-JRGF...

VulnCheck KEV: CVE-2011-4723

The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information...

CVE-2016-10541

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape "" and "" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection...

WordPress WD #Instagram Feed Premium 1.3.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications WD Instagram Feed 1.3.0aaaXSS Vulnerabilities Two cross-site scripting vulnerabilities in the WD Instagram Feed WordPress plugin allow attackers to inject arbitrary web script or HTML by passing payloads through the bio of an Instagram profile...

WordPress WD Instagram Feed Premium 1.3.0 Cross Site Scripting

WD Instagram Feed 1.3.0aaaXSS Vulnerabilities Two cross-site scripting vulnerabilities in the WD Instagram Feed WordPress plugin allow attackers to inject arbitrary web script or HTML by passing payloads through the bio of an Instagram profile or remotely via comments on an Instagram post...

au.net.causal.maven.plugins:boxdb-maven-plugin (>=1.0 <=3.3), au.net.causal.maven.plugins:browserbox-maven-plugin (=1.0) +572 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (>=3.0 <=3.5)

org.codehaus.plexus:plexus-archiver MAVEN version =3.0, =1.0, =0.7.8, =0.6.0, =0.6.0, =0.6.0, =1.4.14, =1.2.1, =1.20, =0.0.3, =0.0.21, =0.0.3, =0.0.3, =0.0.3, =0.0.16 and more Source cves: CVE-2018-1002200 Source advisory: SNYK:JAVA-ORGCODEHAUSPLEXUS-31680...