CVE-2019-5042: Use After Free

An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free. An attacker can send a malicious PDF to trigger this vulnerability...

PT-2019-14841

Name of the Vulnerable Software and Affected Versions linea crate versions through 0.9.4 Description The issue is related to a double free in the Matrix::zip elements method. This occurs when the given trait implementation might panic, allowing an attacker to corrupt or take control of the memory...

Use-After-Free

firefox is vulnerable to use-after-free. The vulnerability exists due to the manipulating video elements which allows an attacker to do a potentially exploitable crash in the application...

PT-2019-5218 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a stored XSS attack that allows an attacker to inject JavaScript into STYLE elements. This can potentially impact the integrity of the data. The exploitation of this issue...

CVE-2019-11744

Some HTML elements, such as title and textarea, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if...

UBUNTU-CVE-2019-11744

Some HTML elements, such as title and textarea, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if...

PT-2019-4815

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 69 Thunderbird versions prior to 68.1 Thunderbird versions prior to 60.9 Firefox ESR versions prior to 60.9 Firefox ESR versions prior to 68.1 Description A use-after-free issue can occur when manipulating video...

Fedora 29 : nfdump (2019-9013b5e75d)

2019-08-14 - Fix compile issues - Fix output buffer size for lzo1xdecompresssafe 2019-08-07 - Fix VerifyExtensionMap 179 2019-08-06 - Fix compile errors 2019-08-05 - Fix nfdump.1 man page. 175 - Fix off by 1 array. 173 - Fix use after free in ModifyCompressFile - Add bound checks in AddExporterSt...

NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0103)

The remote NewStart CGSL host, running version MAIN 4.05, has firefox packages installed that are affected by multiple vulnerabilities: - A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR...

icedtea-web: path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite

It was found that icedtea-web did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows a malicious actor to trigger a service failure.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the blocking/“freezing” of V8 elements. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially crafted web page...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2019:1815-1 Rating: important References: 1120892 1141102 1141649 Cross-References: CVE-2018-20073 CVE-2019-5847 CVE-2019-5848 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUS...

chromium-browser: V8 sealed/frozen elements cause crash

Inappropriate implementation in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system arises from the failure to take measures to eliminate special elements used in the operating system command set, allowing attackers to execute arbitrary commands with root privileges.

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system exists due to the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary comman...

UBUNTU-CVE-2019-12970

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of...

PT-2019-18693 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The application fails to properly neutralize special elements, potentially allowing attackers to modify intended OS commands sent to downstream components. This could enable attacke...

CVE-2019-13075

Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a...

Malicious Package

smartsearchwp is a malicious package. The package contains malicious code that steal credentials from websites it is loaded in when executed. DOM elements are traversed for usernames and passwords, which are subsequently uploaded to a remote server. Port scans of local gateway are performed and...

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in @apollo/gateway...

CVE-2019-12601: Improper Neutralization of Special Elements used in an SQL Command

SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection issue 3 of 3...