7282 matches found
await vs return vs return await
When writing async functions, there are differences between await vs return vs return await, and picking the right one is important. Let's start with this async function: async function waitAndMaybeReject // Wait one second await new Promiser = setTimeoutr, 1000; // Toss a coin const isHeads =...
Microsoft Edge: Chakra: JIT: BailOutOnTaggedValue bailouts can be generated for constant values(CVE-2017-11839)
In the Chakra's JIT compilation process, it stores variables' type information by basic block. function optb let o; if b // BASIC BLOCK a o = ; else // BASIC BLOCK b o = 1.1; // BASIC BLOCK c return o; For example, let's think the above code gets optimized. At the basic block a, the type of "o"...
Microsoft Edge Chakra JIT - 'BailOutOnTaggedValue' Bailouts Type Confusion
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1364 1. In the Chakra's JIT compilation process, it stores variables' type information by basic block. function optb let o; if b // BASIC BLOCK a o = ; else // BASIC BLOCK b o = 1.1; // BASIC BLOCK c return o; For example, let's...
CVE-2017-16899
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the readtextobject functions in read.c and read13.c...
CVE-2017-16869
CVE-2017-16869 concerns UPX 3.94 where p_mach.cpp (in the canPack and unpack paths) can be triggered by a crafted Mach-O file to cause a denial of service via an invalid memory access, with the vendor stating there is no security implication. SUSE/Security entries reiterate the affected UPX 3.94 ...
Adobe Acrobat and Reader Security Bypass (APSB17-36: CVE-2017-16380)
A Security Bypass vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to the way Adobe Reader handles certain API functions, that could lead to bypass restrictions. A remote attacker can exploit this issue by enticing a target user to open a specially crafted PDF file...
The vulnerability in the Vivint Sky Control Panel web application lies in the lack of authentication for critical functions. This allows a malicious individual to activate or deactivate the security system and alter other security settings.
The vulnerability of the Vivint Sky Control Panel web application is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to enable and disable the alarm system and modify other security settings via the web interface the default por...
Debian DSA-4027-1 : postgresql-9.4 - security update
A vulnerabilitiy has been found in the PostgreSQL database system: Denial of service and potential memory disclosure in the jsonpopulaterecordset and jsonbpopulaterecordset functions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
[SECURITY] [DSA 4027-1] postgresql-9.4 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4027-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 09, 2017 https://www.debian.org/security/faq -...
Vulnerability in core server (CVE-2017-15098)
Memory disclosure in JSON functions...
pcc - PHP Secure Configuration Checker
Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful tasks. Idea one single file for ea...
Fedora 26 : SDL2 (2017-5b132e3803)
Added audio stream conversion functions : - SDLNewAudioStream - SDLAudioStreamPut - SDLAudioStreamGet - SDLAudioStreamAvailable - SDLAudioStreamFlush - SDLAudioStreamClear - SDLFreeAudioStream - Added functions to query and set the SDL memory allocation functions : - SDLGetMemoryFunctions -...
Sql injection
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to 1 unsubscribeforum.php or 2 unsubscribetopic.php in mobiquo/functions/...
DEBIAN-CVE-2017-12613
When aprtimeexp or aprosexptime functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an aprtimeexpt value, potentially revealing the contents of a different static heap value or...
CVE-2014-9148
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...
CVE-2017-15289
The mode4and5 write functions in hw/display/cirrusvga.c in Qemu allow local OS guest privileged users to cause a denial of service out-of-bounds write access and Qemu process crash via vectors related to dst calculation...
Chrome 35.0.1916.153 - Sandbox Escape Command Execution
Chrome 35.0.1916.153 - Sandbox Escape Command Execution Sandbox escape Chrome exploit. Allows the execution of local binaries, read/write functions and exfiltration of Chrome OAuth tokens to remote server. More info: https://bugs.chromium.org/p/chromium/issues/detail?id=386988 Download:...
mysql: Server: UDF unspecified vulnerability (CPU Jul 2017)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: UDF. Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...
Qards - Stored Cross-Site Scripting (XSS)
Google Dork: inurl:"plugins/qards" Qards provides you easy option to drag and edit every part and element of your site in the front-end, you will never have to write any code to change the layout or to change any part of the site like the traditional WordPress way. The vulnerable script...
