CVE-2018-17635

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17635: Use After Free

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2020-10608

Name of the Vulnerable Software and Affected Versions GPAC versions prior to 0.8.0 Description An issue was discovered in libgpac.a that can cause a denial of service via a crafted MP4 file. The issue is related to an invalid pointer dereference in the gf odf delete descriptor function in odf/des...

AXIOS ITALIA Axioscloud Sissiweb Registro Elettronico Cross-Site Scripting Vulnerability

AXIOS ITALIA Axioscloud Sissiweb Registro Elettronico is a cloud-based software, also available as an app, which, in addition to the standardized corporate management, also has specialized functions for the management of the learning process, with the goal of supporting the management of teachers...

PT-2018-14462

Name of the Vulnerable Software and Affected Versions AXIOS ITALIA Axioscloud Sissiweb Registro Elettronico version 1.7.0 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is possible due to the presence of a flaw in the "secret/relogoff.aspx"...

PT-2018-14108

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.2.0.9297 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw...

kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker

A flaw has been identified in the Linux kernel's implementation of validmasterdesc in which a memory buffer would be compared to a userspace value with an incorrect size of comparison. By bruteforcing the comparison, an attacker could determine what was in memory after the description and possibl...

CVE-2018-10138

The CATALooK.netStore module through 7.2.8 for DNN formerly DotNetNuke allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter...

CVE-2018-10138

The CATALooK.netStore module through 7.2.8 for DNN formerly DotNetNuke allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter...

kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker

A flaw has been identified in the Linux kernel's implementation of validmasterdesc in which a memory buffer would be compared to a userspace value with an incorrect size of comparison. By bruteforcing the comparison, an attacker could determine what was in memory after the description and possibl...

CVE-2017-17919

SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

CVE-2017-17919

SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

CVE-2017-17919: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

CVE-2017-1002023

Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easyteammanagerdescedit.php...

PT-2017-11012

Name of the Vulnerable Software and Affected Versions Easy Team Manager version 1.3.2 Description The issue arises from a lack of sanitization of the id before it is used in an SQL statement, specifically in the file ./easy-team-manager/inc/easy team manager desc edit.php. This could potentially...

Qemu: virtio: null pointer dereference in virtqueu_map_desc

The virtqueuemapdesc function in hw/virtio/virtio.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash via a large I/O descriptor buffer length value...

Qemu: virtio: null pointer dereference in virtqueu_map_desc

The virtqueuemapdesc function in hw/virtio/virtio.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash via a large I/O descriptor buffer length value...

PT-2017-11997

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns SQL injection in a specific PHP file, sys article.php, located in the dapur/apps/app article directory. This SQL injection is possible via several POST parameters: parent id, desc, keys, an...

CVE-2017-11415: Improper Neutralization of Special Elements used in an SQL Command

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/sysarticle.php via $POST'parentid', $POST'desc', $POST'keys', and $POST'level'...

PT-2017-16709

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-ugly affected versions not specified Description The issue allows remote attackers to cause a denial of service out-of-bounds heap read via vectors involving extended content descriptors. This is due to a problem in the g...