816 matches found
Prototype Pollution
deep-extend is vulnerable to prototype pollution attacks. The vulnerability exists in the utility function where the prototype of Object can be overwritten to add or modify existing property on all objects...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
Yxcms Cross-Site Scripting Vulnerability
Yxcms building system compatible cell phone is a website creation system. A cross-site scripting vulnerability exists in version 1.4.7 of the Yxcms building system compatible cell phone. A remote attacker can create a cross-site scripting vulnerability by making a request to...
PT-2018-18630
Name of the Vulnerable Software and Affected Versions Yxcms building system version 1.4.7 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the content parameter in specific PHP files, namely extend guestbook.php, whi...
Node.js third-party modules: Prototype pollution attack (deep-extend)
As discussed in 309391, here's the separate report for each of the library. This one is the information for the deep-extend library. Module: deep-extend Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of...
CVE-2018-5720
An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery CSRF vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead...
CVE-2018-5720
CVE-2018-5720 affects the DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103. The issue is a Cross-site Request Forgery (CSRF) that lets an attacker hijack user authentication to modify settings, including changing usernames/passwords and the Wi‑Fi password. Public r...
CVE-2018-5720
An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery CSRF vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead...
PT-2018-17110
Name of the Vulnerable Software and Affected Versions: DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 Description: A Cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that modify settings, potentially leading...
CVE-2018-5720: Cross-Site Request Forgery (CSRF)
An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery CSRF vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead...
CVE-2017-12867
The SimpleSAMLAuthTimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset...
The vulnerability of the zend_string_extend function in the PHP interpreter allows a attacker to cause a service failure or exert other effects.
The vulnerability of the zendstringextend function in the PHP interpreter is related to insufficient control over modifications to object instances of the sequence type. Exploiting this vulnerability could allow a malicious actor to cause service failures or other adverse effects e.g., terminatio...
Exiv2 Denial of Service Vulnerability (CNVD-2017-27706)
Exiv2 is a suite of C++ libraries and command line applications for managing image metadata by software developer Andreas Huggel, which provides fast and easy reading and writing of image metadata in a variety of EXIF, IPTC and XMP formats. A denial of service vulnerability exists in the...
Design/Logic Flaw
There is an illegal address access in the extendaliastable function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service...
PT-2017-12097
Name of the Vulnerable Software and Affected Versions Exiv2 version 0.26 Description The issue is related to an illegal address access in the extend alias table function in localealias.c. A crafted input can lead to a remote denial of service. Recommendations For Exiv2 version 0.26, consider...
PHP Denial of Service Vulnerability (CNVD-2017-06940)
PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language supports multiple syntaxes, multiple databases and operating systems, and support for C, C++ for program extensions and so on. A...
UBUNTU-CVE-2017-8923
The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact by leveraging a script's use ...
PT-2017-2598
Name of the Vulnerable Software and Affected Versions PHP versions through 7.1.5 Description The issue is related to the zend string extend function in PHP, which does not prevent changes to string objects that result in a negative length. This allows remote attackers to cause a denial of service...
CVE-2016-10063
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service application crash or have other unspecified impact via a crafted file, related to extend validity...
CVE-2016-10063
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service application crash or have other unspecified impact via a crafted file, related to extend validity...