Hiroshi Yuki YukiWiki Denial of Service Vulnerability

Hiroshi Yuki YukiWiki is a Wiki engine. A security vulnerability exists in Hiroshi Yuki YukiWiki 2.1.3 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of service significant consumption of CPU and memory resources...

Who Is Agent Tesla?

A powerful, easy-to-use password stealing program known as Agent Tesla has been infecting computers since 2014, but recently this malware strain has seen a surge in popularity -- attracting more than 6,300 customers who pay subscription fees to license the software. Although Agent Tesla includes ...

GHSA-QW96-MM2G-C8M7 Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page...

CVE-2018-1770

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 148686...

CVE-2018-1770: Improper Limitation of a Pathname to a Restricted Directory

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 148686...

CVE-2018-1649

IBM QRadar Incident Forensics 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 144655...

GHSA-89GC-6CW6-4VCH Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2018-17828

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. dot dot in a zip file, because of the function unzzipcat in the bins/unzzipcat-mem.c file...

System.IO.Pipelines DoS

The vulnerability of the System.IO.Pipelines library in .NET Core and ASP.NET Core applications is related to request processing errors. Exploiting this vulnerability allows an attacker to cause service failures through a specially crafted request...

PT-2018-1582 · Microsoft · Net Core +2

Name of the Vulnerable Software and Affected Versions: .NET Core versions 2.1 ASP.NET Core versions 2.1 System.IO.Pipelines affected versions not specified Description: A denial of service issue exists due to improper handling of requests by System.IO.Pipelines. This can be exploited by a remote...

REDAXO CMS Cross-Site Request Forgery Vulnerability

REDAXO CMS is an open source content management system CMS. The system supports custom modules , plug-in extensions , project backup and so on. A cross-site request forgery vulnerability exists in REDAXO CMS version 4.7.2. A remote attacker can add an administrator account with the help of...

DEBIAN-CVE-2017-16654

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

CVE-2017-16654

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

Node.js third-party modules: Code Injection Vulnerability in dot Package

I would like to report a code injection vulnerability in dot. It allows attackers to execute arbitrary JS code, especially when combined with a prototype pollution attack. Module module name: dot version: 1.1.2 npm page: https://www.npmjs.com/package/dot Module Description Created in search of th...

CVE-2017-16654: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

CVE-2018-14581

Redgate .NET Reflector before 10.0.7.774 and SmartAssembly before 6.12.5 allow attackers to execute code by decompiling a compiled .NET object such as a DLL or EXE file with a specific embedded resource file...

CVE-2018-0618

Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-10628

AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution...

DEBIAN-CVE-2018-14036

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in userchangeiconfileauthorizedcb in user.c...

Microsoft Releases Patch Updates for 53 Vulnerabilities In Its Software

It's time to gear up your systems and software for the latest July 2018 Microsoft security patch updates. Microsoft today released security patch updates for 53 vulnerabilities, affecting Windows, Internet Explorer IE, Edge, ChakraCore, .NET Framework, ASP.NET, PowerShell, Visual Studio, and...