Ubiquiti Inc.: [dev-unifi-go.ubnt.com] Insecure CORS, Stealing Cookies

Due to a development designed error page and insecure CORS Header in dev-unifi-go.ubnt.com, the researcher was able to demonstrate how an attacker could steal users cookies by luring the user to access a web page controlled by the attacker...

Heap overflow

The fillthreshholdbuffer function in base/gxhtthresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted PostScript document...

Design/Logic Flaw

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted file...

CVE-2016-10221

The countentries function in pdf-layer.c in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to cause a denial of service stack consumption and application crash via a crafted PDF document...

Design/Logic Flaw

The pdf14open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service use-after-free and application crash via a crafted file that is mishandled in the color management module...

CVE-2016-10218

The pdf14poptransparencygroup function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted file...

CVE-2017-5951

CVE-2017-5951 is a vulnerability in Artifex Ghostscript 9.20 where mem_get_bits_rectangle in base/gdevmem.c could cause a NULL pointer dereference and crash the application when processing a crafted file. This is a remote-denial-of-service/ crash scenario reported in the provided sources; no expl...

CVE-2016-10219

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted file...

CVE-2016-10219

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted file...

CVE-2016-10220

CVE-2016-10220 affects Artifex Ghostscript, specifically Ghostscript 9.20. The vulnerability is in the function gs_makewordimagedevice (base/gsdevmem.c) and can be triggered by a crafted PDF in the PDF Transparency module, leading to a NULL pointer dereference and an application crash (denial of ...

CVE-2017-5951

The memgetbitsrectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted file...

CVE-2016-10217

The pdf14open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service use-after-free and application crash via a crafted file that is mishandled in the color management module...

Google Cloud Platform Compute Engine Instance Metadata Enumeration (Unix)

The remote host appears to be a Google Compute Engine instance. Nessus was able to use the metadata API to collect information about the system. TRUSTED...

CVE-2016-10132

regexp.c in Artifex Software, Inc. MuJS allows attackers to cause a denial of service NULL pointer dereference and crash via vectors related to regular expression compilation...

Null pointer dereference

regexp.c in Artifex Software, Inc. MuJS allows attackers to cause a denial of service NULL pointer dereference and crash via vectors related to regular expression compilation...

qemu security update

CentOS Errata and Security Advisory CESA-2017:0621 An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Ubiquiti Inc.: Ability to log in as any user without authentication if █████████ is empty

Devices that can be monitored by airControl include a ticket based authentication system that allows access to the WebUI using a ticket id. This system had a flaw that allowed unauthenticated access without a valid ticket, given these requirements were met: 1. A device was monitored by airControl...

Moderate: Red Hat Security Advisory: qemu-kvm security and bug fix update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Buffer overflow

Buffer overflow in the main function in jstestmain.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service out-of-bounds write via a crafted file...

CVE-2016-10247

Buffer overflow in the mygetline function in jstestmain.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service out-of-bounds write via a crafted file...