UBUNTU-CVE-2018-14329

In HTSlib 1.8, a race condition in cram/cramio.c might allow local users to overwrite arbitrary files via a symlink attack...

Linux io-prefetch SQL Injection Vulnerability in Multiple Qualcomm Products

Qualcomm MSM8909W and others are central processing unit CPU products for different platforms from Qualcomm, Inc.Linux io-prefetch is one of the Linux system preloading components. A SQL injection vulnerability exists in Linux io-prefetch in multiple Qualcomm products. A remote attacker could...

django_make_app is vulnerable to Code Injection

An exploitable vulnerability exists in the YAML parsing functionality in the readyamlfile method in ioutils.py in djangomakeapp 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability...

Eve allows execution of arbitrary code

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

ICSA-18-347-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: EN100 Ethernet Communication Module and SIPROTEC 5 relays Vulnerabilities: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

Heap overflow

Fast C++ CSV Parser aka fast-cpp-csv-parser before 2018-07-06 has a heap-based buffer over-read in io::trimchars in csv.h...

UBUNTU-CVE-2018-13421

Fast C++ CSV Parser aka fast-cpp-csv-parser before 2018-07-06 has a heap-based buffer over-read in io::trimchars in csv.h...

CVE-2018-13421

Fast C++ CSV Parser aka fast-cpp-csv-parser before 2018-07-06 has a heap-based buffer over-read in io::trimchars in csv.h...

CVE-2017-11088

Improper Input Validation in Linux io-prefetch in Snapdragon Mobile and Snapdragon Wear, A SQL injection vulnerability exists in versions MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 835, SD 845...

CVE-2017-11088

CVE-2017-11088 is an SQL injection vulnerability described as a result of improper input validation in the Linux io-prefetch component on Qualcomm/Qualcomm-derived platforms. Public entries indicate affected Qualcomm/SoC families include MSM8909W, MSM8996AU and various Snapdragon SoCs (SD 210/212...

io-n-joy.com XSS vulnerability

Open Bug Bounty ID: OBB-638021 Description| Value ---|--- Affected Website:| io-n-joy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Linux kernel information disclosure vulnerability (CNVD-2018-16269)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. An information disclosure vulnerability exists in Linux kernel versions 3.18 through 4.16, which arises from a program's failure to properly handle the SGIO ioctl. An...

kernel: memory leak when merging buffers in SCSI IO vectors

It was found that in the Linux kernel through v4.14-rc5, biomapuseriov and biounmapuser in 'block/bio.c' do unbalanced pages refcounting if IO vector has small consecutive buffers belonging to the same page. bioaddpcpage merges them into one, but the page reference is never dropped, causing a...

kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access

It was found that AIO interface didn't use the proper rwverifyarea helper function with extended functionality, for example, mandatory locking on the file. Also rwverifyarea makes extended checks, for example, that the size of the access doesn't cause overflow of the provided offset limits. This...

[SECURITY] Fedora 27 Update: perl-Archive-Tar-2.28-1.fc27

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support...

CVE-2018-4236

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "IOGraphics" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

console-io authentication bypass vulnerability

Cloud Commander is a Web file manager with console and editor. console-io is one of the Web-based console programs. A security vulnerability exists in console-io 2.2.13 and earlier versions, which stems from the program not configuring socket.io to perform authentication. A remote attacker could...

CVE-2016-10615

curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...

CVE-2016-10615

The CVE-2016-10615 issue affects the curses package, where the library downloads binary resources over HTTP. The underlying problem is insecure HTTP delivery, enabling a MitM attacker to swap the requested binary, potentially leading to remote code execution on the host. The connected advisories ...

CVE-2016-10532

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running...