CVE-2017-16899

An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the readtextobject functions in read.c and read13.c...

CVE-2017-16869

CVE-2017-16869 concerns UPX 3.94 where p_mach.cpp (in the canPack and unpack paths) can be triggered by a crafted Mach-O file to cause a denial of service via an invalid memory access, with the vendor stating there is no security implication. SUSE/Security entries reiterate the affected UPX 3.94 ...

Adobe Acrobat and Reader Security Bypass (APSB17-36: CVE-2017-16380)

A Security Bypass vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to the way Adobe Reader handles certain API functions, that could lead to bypass restrictions. A remote attacker can exploit this issue by enticing a target user to open a specially crafted PDF file...

The vulnerability in the Vivint Sky Control Panel web application lies in the lack of authentication for critical functions. This allows a malicious individual to activate or deactivate the security system and alter other security settings.

The vulnerability of the Vivint Sky Control Panel web application is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to enable and disable the alarm system and modify other security settings via the web interface the default por...

Debian DSA-4027-1 : postgresql-9.4 - security update

A vulnerabilitiy has been found in the PostgreSQL database system: Denial of service and potential memory disclosure in the jsonpopulaterecordset and jsonbpopulaterecordset functions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 4027-1] postgresql-9.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4027-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 09, 2017 https://www.debian.org/security/faq -...

Vulnerability in core server (CVE-2017-15098)

Memory disclosure in JSON functions...

pcc - PHP Secure Configuration Checker

Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful tasks. Idea one single file for ea...

Fedora 26 : SDL2 (2017-5b132e3803)

Added audio stream conversion functions : - SDLNewAudioStream - SDLAudioStreamPut - SDLAudioStreamGet - SDLAudioStreamAvailable - SDLAudioStreamFlush - SDLAudioStreamClear - SDLFreeAudioStream - Added functions to query and set the SDL memory allocation functions : - SDLGetMemoryFunctions -...

Sql injection

Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to 1 unsubscribeforum.php or 2 unsubscribetopic.php in mobiquo/functions/...

DEBIAN-CVE-2017-12613

When aprtimeexp or aprosexptime functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an aprtimeexpt value, potentially revealing the contents of a different static heap value or...

CVE-2014-9148

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...

CVE-2017-15289

The mode4and5 write functions in hw/display/cirrusvga.c in Qemu allow local OS guest privileged users to cause a denial of service out-of-bounds write access and Qemu process crash via vectors related to dst calculation...

Chrome 35.0.1916.153 - Sandbox Escape Command Execution

Chrome 35.0.1916.153 - Sandbox Escape Command Execution Sandbox escape Chrome exploit. Allows the execution of local binaries, read/write functions and exfiltration of Chrome OAuth tokens to remote server. More info: https://bugs.chromium.org/p/chromium/issues/detail?id=386988 Download:...

mysql: Server: UDF unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: UDF. Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

Qards - Stored Cross-Site Scripting (XSS)

Google Dork: inurl:"plugins/qards" Qards provides you easy option to drag and edit every part and element of your site in the front-end, you will never have to write any code to change the layout or to change any part of the site like the traditional WordPress way. The vulnerable script...

PostgreSQL vulnerabilities

The PostgreSQL project reports: CVE-2017-15098: Memory disclosure in JSON functions CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges...

The vulnerability of the microprogrammed logic controllers from Rockwell Automation, the Micrologix 1100 and Micrologix 1400, is related to deficiencies in access control. This allows a intruder to remove all administrators, thereby disabling additional functions of the device.

The vulnerability of the microprogrammed logic controllers from Rockwell Automation, the Micrologix 1100 and Micrologix 1400, is related to deficiencies in access control. Exploiting this vulnerability could allow a person with administrator privileges to remotely remove all administrators, there...

Grab: www.drivegrab.com SQL injection

Summary: The website uses a WordPress plugin called Formidable Pro. I found an SQL injection in the plugin code. Description: The plugin allows the site admin to create forms to be filled by users. For this end it implements some AJAX functions, including one to preview or actually just view a...

CVE-2015-5070

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to...