1322 matches found
CVE-2015-9268
Nullsoft Scriptable Install System NSIS before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime...
CVE-2015-9268: Improper Input Validation
Nullsoft Scriptable Install System NSIS before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime...
PT-2018-4577
Name of the Vulnerable Software and Affected Versions Nullsoft Scriptable Install System NSIS versions prior to 2.49 Description The issue concerns unsafe implicit linking against Version.dll, meaning there is no protection mechanism to resolve the dependency at an appropriate time during runtime...
Remote Code Execution (RCE)
Microsoft.ChakraCore is vulnerable to remote code execution RCE attacks. The library interpreter contains a Implicit call bypass in GlobalOpt.cpp, allowing a malicious user to inject and execute arbitrary code...
CVE-2018-1000125
inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack...
Doorkeeper gem has stored XSS on authorization consent view
Stored XSS on the OAuth Client's name will cause users being prompted for consent via the "implicit" grant type to execute the XSS payload. The XSS attack could gain access to the user's active session, resulting in account compromise. Any user is susceptible if they click the authorization link...
Microsoft Edge Chakra JIT - Memory Corruption
/ Let's consider the following example code. function opt let arr = ; return arr'x'; // Optimize the "opt" function. for let i = 0; i inline Js::Var ExecuteImplicitCallJs::RecyclableObject function, Js::ImplicitCallFlags flags, Fn implicitCall // For now, we will not allow Function that is marked...
Microsoft Edge Chakra JIT - Memory Corruption
Microsoft Edge Chakra JIT - Memory Corruption / Let's consider the following example code. function opt let arr = ; return arr'x'; // Optimize the "opt" function. for let i = 0; i inline Js::Var ExecuteImplicitCallJs::RecyclableObject function, Js::ImplicitCallFlags flags, Fn implicitCall // For...
SUSE-SU-2017:2932-1 Security update for SuSEfirewall2
This update for SuSEfirewall2 fixes the following issues: - CVE-2017-15638: Fixed a security issue with too open implicit portmapper rules bsc1064127: A source net restriction for rpc services was not taken into account for the implicitly added rules for port 111, making the portmap service...
actionpack Path Traversal vulnerability
Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files...
PT-2017-3335
Name of the Vulnerable Software and Affected Versions Android versions 7.0, 7.1.1, 7.1.2, 8.0 Description The issue is related to errors in resource management in the Media Framework component of the Android operating system, specifically in the ih264d get implicit weights function. This could...
python security and bug fix update
2.7.5-58.0.1 - Add Oracle Linux distribution in platform.py orabug 20812544 2.7.5-58 - Set stream to None in case an open fails. Resolves: rhbz1432003 2.7.5-57 - Fix implicit declaration warnings of functions added by patches 147 and 265 Resolves: rhbz1441237 2.7.5-56 - Fix shutil.makearchive...
Automated posting on Vkontakte public pages using VK API and Python
Vk.com Vkontakte is the most popular social network Russia and Ex-USSR with 430+ million users. Originally it was a Facebook clone. But now, after 10 years of development, these two services are quite different from each other. Traditional advantages of vk.com - huge amount of free music and vide...
An error during signature verification can be treated as a successful verification.
Security update for signature validation on LogoutRequest/LogoutResponse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature...
CVE-2016-6636
The OAuth authorization implementation in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.1; and Ops Manager 1.7.x before...
PT-2016-7011
Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry versions prior to 242 UAA versions 2.x prior to 2.7.4.7 UAA versions 3.x prior to 3.3.0.5 UAA versions 3.4.x prior to 3.4.4 UAA BOSH versions prior to 11.5 UAA BOSH versions 12.x prior to 12.5 Elastic Runtime versions 1.6...
International Components for Unicode Heap Buffer Overflow DoS
The vulnerability of the resolveImplicitLevels function common/ubidi.c in the implementation of the Unicode Bidirectional Algorithm of the International Components for Unicode library is caused by a buffer overflow in the dynamic memory. Exploiting this vulnerability can allow an attacker to caus...
rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url
It was found that the OAuth implementation in librest, a helper library for RESTful services, incorrectly truncated the pointer returned by the restproxycallgeturl call. An attacker could use this flaw to crash an application using the librest library...