unicode code execution vulnerability

unicode is a tool that provides data from unicode for nodejs. A security vulnerability exists in unicode versions prior to 9.0.0, which originates from a program that insecurely downloads resources over the HTTP protocol. An attacker can exploit the vulnerability to alter or read resources and...

CVE-2018-9976

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-9950

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Foxit Reader ConvertToPDF_x86 jpg Parsing Out-of-Bounds Read Information Disclosure Vulnerability (CNVD-2018-09995)

Foxit Reader is a small PDF document viewer and printing program. Foxit Reader has a security vulnerability in ConvertToPDFx86.dll, which can be exploited by attackers to obtain sensitive information or even execute arbitrary code due to a lack of proper validation of user-supplied data...

Joruri Gw vulnerable to arbitrary file upload

Overview Joruri Gw provided by SiteBridge Inc. is groupware which runs on Ruby on Rails. Joruri Gw contains a vulnerability that may allow an attacker to upload arbitrary files CWE-434. Shoji Baba of Kobe Digital Labo, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

SUSE-SU-2018:0947-1 Security update for evince

This update for evince fixes the following issues: - CVE-2017-1000159: Command injection in evince via filename when printing to PDF could lead to command execution bsc1070046...

DEBIAN-CVE-2018-1000051

Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fzkeepkeystorable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF...

USN-3529-1 thunderbird vulnerabilities

It was discovered that a From address encoded with a null character is cut off in the message header display. An attacker could potentially exploit this to spoof the sender address. CVE-2017-7829 It was discovered that it is possible to execute JavaScript in RSS feeds in some circumstances. If a...

DEBIAN-CVE-2017-12178

xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code...

DEBIAN-CVE-2017-12181

xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code...

The installer of Music Center for PC may insecurely load Dynamic Link Libraries

Overview Music Center for PC provided by Sony Video & Sound Products Inc. is a file management tool. The installer of Music Center for PC contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Note that this vulnerability is different from...

The vulnerability of the FileReceiveServlet servlet in the network management system by Brocade Network Advisor allows a attacker to upload a malicious file into the file system, where it can be executed.

The vulnerability of the FileReceiveServlet server in the IP and SAN network management system provided by Brocade Network Advisor exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download a malicious fi...

CVE-2017-16588

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

The installer of Media Go and Music Center for PC may insecurely load Dynamic Link Libraries

Overview Media Go and Music Center for PC provided by Sony Group are file management tools. The installer of Media Go and Music Center for PC contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami of Tachibana Lab. and Shun Suza...

CVE-2017-10615

A vulnerability in the pluggable authentication module PAM of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM. Affected Juniper Networks Junos OS releases are: 14.1 fr...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

PT-2017-15596 · Sdl +1 · Sdl Image +1

Name of the Vulnerable Software and Affected Versions: SDL image version 2.0.1 Description: A buffer overflow vulnerability exists in the XCF property handling functionality. A specially crafted XCF file can cause a stack-based buffer overflow, potentially leading to code execution. An attacker c...

OpenJPEG lib/openjp2/j2k.c File Denial of Service Vulnerability

OpenJPEG is a C-based open source JPEG 2000 codec . A security vulnerability exists in the opjj2kwritesot of the lib/openjp2/j2k.c file in OpenJPEG version 2.2.0. A remote attacker could exploit this vulnerability to cause a denial of service heap buffer overflow or code execution...

SUSE-SU-2017:2251-1 Security update for mercurial

This update for mercurial fixes the following issues: - CVE-2017-1000115: path traversal via symlink could lead to unauthorized access bsc1053344 - CVE-2017-1000116: argument injection in SSH URLs could lead to client-side code execution bsc1052696...

Installer and self-extracting archive containing the installer of TDB CA TypeA use software may insecurely load Dynamic Link Libraries

Overview TDB CA TypeA use software provided by Teikoku Databank, Ltd. is a software which provides environment for using system and management function of TDB electronic authentication service TypeA. The installer and the self-extracting archive containing the installer of TDB CA TypeA use softwa...