CVE-2019-19909: Improper Control of Generation of Code

An issue was discovered in Public Knowledge Project PKP pkp-lib before 3.1.2-2, as used in Open Journal Systems OJS before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

CVE-2019-17358: Deserialization of Untrusted Data

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

WS-2019-0565

nDPI in versions 2.4 to 3.0 is vulnerable toHeap-buffer-overflow in ndpiintcheckstun, related to src/lib/protocols/stun.c...

WS-2019-0546

nDPI in versions 3.0 is vulnerable to Heap-buffer-overflow in ndpisearchmemcached , related to src/lib/protocols/memcached.c...

CVE-2012-1577

lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0...

CVE-2012-1577: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0...

Design/Logic Flaw

xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGLDRIVERSPATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen...

Cross site request forgery (csrf)

TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request...

CVE-2019-19491

TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request...

PT-2019-15856

Name of the Vulnerable Software and Affected Versions TestLink version 1.9.19 Description The issue allows for XSS attacks through specific parameters and requests. This can be achieved via the edit parameter in lib/testcases/archiveData.php, the reqURI parameter in index.php, or the URI in a...

CVE-2019-19491: Improper Neutralization of Input During Web Page Generation

TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request...

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

CVE-2019-16255: Improper Control of Generation of Code

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

Dozens of Severe Flaws Found in 4 Popular Open Source VNC Software

Four popular open-source VNC remote desktop applications have been found vulnerable to a total of 37 security vulnerabilities, many of which went unnoticed for the last 20 years and most severe could allow remote attackers to compromise a targeted system. VNC virtual network computing is an open...

UBUNTU-CVE-2013-2092

Cross-site Scripting XSS in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php...

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

[SECURITY] Fedora 30 Update: freetds-1.1.20-1.fc30

FreeTDS is a project to document and implement the TDS Tabular DataStream protocol. TDS is used by SybaseTM and MicrosoftTM for client to database server communications. FreeTDS includes call level interfaces for DB-Lib, CT-Lib, and ODBC...

[SECURITY] Fedora 31 Update: freetds-1.1.20-1.fc31

FreeTDS is a project to document and implement the TDS Tabular DataStream protocol. TDS is used by SybaseTM and MicrosoftTM for client to database server communications. FreeTDS includes call level interfaces for DB-Lib, CT-Lib, and ODBC...

CVE-2019-18397: Buffer Copy without Checking Size of Input

A buffer overflow in the fribidigetparembeddinglevelsex function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application...