2964 matches found
Debian: Security Advisory (DSA-5038-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cross site scripting
jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting XSS vulnerability. The code for XSS payload is always visible, but an attacker can use other techniques to hide the code...
ghostscript:gstoraster_fuzzer: Crash in pdfi_array_get
Detailed Report: https://oss-fuzz.com/testcase?key=6198266570604544 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000009b98 Crash State: pdfiarrayget pdfiarraygettype...
Expert Details macOS Bug That Could Let Malware Bypass Gatekeeper Security
Apple recently fixed a security vulnerability in the macOS operating system that could be potentially exploited by a threat actor to "trivially and reliably" bypass a "myriad of foundational macOS security mechanisms" and run arbitrary code. Security researcher Patrick Wardle detailed the discove...
ghostscript:gstoraster_fuzzer: Global-buffer-overflow in ps_font_def_func
Detailed Report: https://oss-fuzz.com/testcase?key=5277536983056384 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Global-buffer-overflow READ Crash Address: 0x00000199def1 Crash State: psfontdeffunc...
Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.
...
CVE-2021-44657
In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...
Default credentials
In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...
CVE-2021-44657
In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...
CVE-2021-4007
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is...
Input validation
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is...
CVE-2021-4007 Rapid7 Insight Agent Privilege Escalation
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is...
ghostscript:gstoraster_fuzzer: Stack-buffer-overflow in pdfi_annot_draw
Detailed Report: https://oss-fuzz.com/testcase?key=5662241045741568 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7fbc61ad24d4 Crash State: pdfiannotdraw...
ghostscript:gstoraster_fuzzer: Heap-buffer-overflow in pdfi_dereference
Detailed Report: https://oss-fuzz.com/testcase?key=5203769325912064 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x631000063928 Crash State: pdfidereference...
PT-2021-21174
Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.1.0 through 6.1.2 FortiWeb versions 6.2.0 through 6.2.6 FortiWeb versions 6.3.0 through 6.3.15 FortiWeb versions 6.4.0 and 6.4.1 Description Multiple command injection vulnerabilities in the command line interpreter may all...
Fortinet FortiWeb 操作系统操作系统命令注入漏洞
Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb A command injection...
CVE-2021-36195: Improper Neutralization of Special Elements used in an OS Command
Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted...
[SECURITY] Fedora 35 Update: q-7.11-44.fc35
Q is a powerful and extensible functional programming language based on the term rewriting calculus. You specify an arbitrary system of equations which the interpreter uses as rewrite rules to reduce expressions to normal form. Q is useful for scientific programming and other advanced application...
AZL-41261 CVE-2021-43519 affecting package ceph for versions less than 18.2.2-3
Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...