PT-2018-11815 · Google +2 · Gperftools +2

Name of the Vulnerable Software and Affected Versions: Google gperftools version 2.7 Description: The issue is related to a memory leak in malloc extension.cc, specifically involving MallocExtension::Register and InitModule. However, the software maintainer disputes this, stating it is a...

DEBIAN-CVE-2018-13405

The inodeinitowner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigge...

Design/Logic Flaw

The inodeinitowner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigge...

PT-2018-10167 · Canonical +3 · Cloud-Init +3

Name of the Vulnerable Software and Affected Versions: cloud-init versions 0.6.2 and newer Description: The default cloud-init configuration in affected versions includes "ssh deletekeys: 0", which disables the deletion of ssh host keys. This could lead to instances created by cloning a golden...

DEBIAN-CVE-2018-13303

In FFmpeg 4.0.1, a missing check for failure of a call to initgetbits8 in the avprivac3parseheader function in libavcodec/ac3parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service...

PostgreSQL Backlink Vulnerability

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A backlink vulnerability exists in the Red Hat initialization scrip...

PT-2018-1961

Name of the Vulnerable Software and Affected Versions Android versions 9 Description The issue is related to the CAacDecoder Init function in the aacdecoder.cpp file of the Android operating system, which is associated with an out of bounds write due to a missing bounds check. This could lead to...

Adobe Issues Patch for Actively Exploited Flash Player Zero-Day Exploit

If you have already uninstalled Flash player, well done! But if you haven't, here's another great reason for ditching it. Adobe has released a security patch update for a critical vulnerability in its Flash Player software that is actively being exploited in the wild by hackers in targeted attack...

mruby Denial of Service Vulnerability (CNVD-2018-14714)

mruby is a lightweight implementation of the Ruby language. A security vulnerability exists in the 'initcopy' function of the kernel.c file in mruby version 1.4.1. An attacker can exploit this vulnerability to cause a denial of service uninitialized pointer usage and application crash...

Denial of Service Vulnerability in MMS Protocol Initialization of Sifang CSI-200EA Measurement and Control Device

CSI-200EA measurement and control device is mainly used in substation automation system of 110kV and above voltage level. A denial of service vulnerability exists in the initialization of the MMS protocol of the Sifang CSI-200EA measurement and control device. An attacker can cause the device por...

PT-2018-10711

Name of the Vulnerable Software and Affected Versions SELA aka SimplE Lossless Audio version 0.1.2-alpha Description The issue is a stack-based buffer overflow in the init apev2 keys function, located in the core/apev2.c file. Recommendations For SELA aka SimplE Lossless Audio version 0.1.2-alpha...

Virtuozzo 7 : readykernel-patch (VZA-2018-036)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - It was found that sctpmakechunk function did not check if the chunk length for INIT and INITACK packets was within the...

Cross site scripting

i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but i...

CVE-2017-16010

i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but i...

CVE-2017-16010

CVE-2017-16010 : In i18next, if you call init with interpolation options and do not set escapeValue, the value defaults to undefined, causing user input to be unescaped and enabling cross-site scripting. Affected: i18next 2.0.0 and later. Exploitation details and proof-of-concept are described in...

CVE-2017-16010

Removed by vendor...

PT-2018-6040

Name of the Vulnerable Software and Affected Versions: i18next versions 2.0.0 and later Description: The issue concerns a cross-site scripting vulnerability in the i18next language translation framework. When using the .init method and passing interpolation options without specifying an...

CVE-2016-8656

Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege escalation...

CVE-2016-8656: Improper Access Control

Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege escalation...

PT-2018-5048

Name of the Vulnerable Software and Affected Versions Jboss jbossas versions prior to 5.2.0-23 Jboss jbossas versions prior to 6.4.13 Jboss jbossas versions prior to 7.0.5 Description The issue is related to unsafe file handling in the jboss init script, which could result in local privilege...