CVE-2018-17672

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17672

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

DEBIAN-CVE-2018-16846

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices...

CVE-2018-16846

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices...

Denial of service

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices...

CVE-2018-16846

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices...

CVE-2018-16846

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices...

Authentication Bypass

openshift elasticsearch is vulnerable to authentication bypass. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an extern...

UBUNTU-CVE-2018-16846

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices...

CVE-2018-16846

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices...

Foxit Reader array Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of arr...

PT-2018-5382 · Red Hat · Openshift Enterprise

Name of the Vulnerable Software and Affected Versions: Openshift Enterprise versions affected versions not specified Description: A flaw was found in Openshift Enterprise that allows an attacker to bypass authentication and access Elasticsearch without a token, given they have knowledge of the na...

sam2p heap buffer overflow vulnerability (CNVD-2018-15515)

sam2p is a command-line utility that converts many raster bitmap image formats such as GIF, JPG/JPEG, and PNG to PostScript or PDF files. giflib is a set of portable tools and library routines for working with GIF images. A heap buffer overflow vulnerability exists in the dgiflib.c file in GIFLIB...

Addressing Innumeracy in Reporting

Anyone involved in cybersecurity reporting needs a strong sense of numeracy, or mathematical literacy. I see two sorts of examples of innumeracy repeatedly in the media. The first involves the time value of money. Recently CNN claimed Amazon CEO Jeff Bezos was the "richest person in history" and...

3: authentication bypass for elasticsearch with external routes

An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices...

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices

lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if !result return JSValue::encodethrowOutOfMemoryErrorexec, scope; for unsigned k = 0; k initializeIndexvm, k, v; ... |JSArray::tryCreateForInitializationPrivate| will return an uninitialized...

typography.com XSS vulnerability

Open Bug Bounty ID: OBB-196404 Description| Value ---|--- Affected Website:| typography.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Algolia: Stored XSS from Display Settings triggered on Save and viewing realtime search demo

Here are the steps to trigger the XSS: 1. Create a JSON record that will contain the following attribute: "": "XSS attribute" 2. Go to Indices - Display and select the attribute under Attributes for Faceting and click save. 3. Note that XSS is triggered multiple times on that page. 4. XSS is now...

minissdpd Denial of Service Vulnerability

minissdpd is a set of daemons for managing SSDP on Posix systems. A security vulnerability exists in minissdpd version 1.2.20130907-3, which stems from the program failing to properly handle array indexes. An attacker can exploit the vulnerability by sending invalid requests to cause a denial of...