in fisharebest/webtrees

Description In fix commit https://github.com/fisharebest/webtrees/commit/fc904122e0c1b55f274bc4c8cd883c266176e34e, the fix was to set CSP to script-src in HTML files to none. Webtrees by default has X-Frame-Options headers to prevent clickjacking, but since X-Frame-Options: SAMEORIGIN, it is...

Password stored in plain text

Overview parse-server is an open source backend that can be deployed to any infrastructure that can run Node.js. In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication ...

CVE-2019-1010069

moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txtadd. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae...

DEBIAN-CVE-2018-1000222

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit...

CVE-2018-1000199

The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modifyuserhwbreakpoint that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in...

CVE-2015-8985

The popfailstack function in the GNU C Library aka glibc or libc6 allows context-dependent attackers to cause a denial of service assertion failure and application crash via vectors related to extended regular expression processing...

Internet Bug Bounty: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization

The bug report at: https://bugs.php.net/bug.php?id=73367 The fix commit at: https://github.com/php/php-src/commit/0426b916df396a23e5c34514e4f2f0627efdcdf0...

Internet Bug Bounty: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow

bug report at: https://bugs.php.net/bug.php?id=73331 fix commit at: https://github.com/php/php-src/commit/6045de69c7dedcba3eadf7c4bba424b19c81d00d...

Internet Bug Bounty: Use-after-free in unserialize()

The bug report at: https://bugs.php.net/bug.php?id=73147 The fix commit at: https://github.com/php/php-src/commit/0e6fe3a4c96be2d3e88389a5776f878021b4c59f...

Internet Bug Bounty: Memory Corruption in During Deserialized-object Destruction

The bug report at: https://bugs.php.net/bug.php?id=73052 The fix commit at: https://github.com/php/php-src/commit/6a7cc8ff85827fa9ac715b3a83c2d9147f33cd43...