UBUNTU-CVE-2019-9705

Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service memory consumption via a large crontab file because an unlimited number of lines is accepted...

CVE-2019-9705

Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service memory consumption via a large crontab file because an unlimited number of lines is accepted...

Vixie cron denial of service vulnerability (CNVD-2019-13244)

Vixie cron is a full-featured cron implementation based on SysV cron. cron is a daemon that runs scheduled tasks based on input from the command crontab. A denial of service vulnerability exists in previous versions of the Vixie Cron 3.0pl1-133 Debian package. The vulnerability stems from accepti...

Authorization Bypass

openssh is vulnerable to authorization bypass attacks. The vulnerability exists as sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshdconfig, which allows remote attackers to bypass intended environment restrictions by using a substring located before a...

DEBIAN-CVE-2018-16864

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges...

ALPINE-CVE-2019-5882

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer...

CVE-2019-5882

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer...

DEBIAN-CVE-2019-5882

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer...

CVE-2019-5882

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer...

CVE-2019-5882: Use After Free

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer...

SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2018:1892-1)

This update for nodejs6 to version 6.14.3 fixes the following issues: The following security vulnerability was addressed : - Fixed a denial of service DoS vulnerability in Buffer.fill, which could hang when being called CVE-2018-7167, bsc1097375. The following other changes were made : - Use...

TerraMaster TOS Cross-Site Scripting Vulnerability (CNVD-2019-00662)

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization. A cross-site scripting vulnerability exists in the ajaxdata.php endpoint in...

CVE-2018-13329

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...

CVE-2018-13329: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...

PT-2018-11753

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript code via the lines URL parameter in the ajaxdata.php file, potentially leading to cross-site scripting attacks. Recommendations For TerraMaster TOS...

Linux systemd Line Splitting

systemd: reexec state injection: fgets on overlong lines leads to line splitting CVE-2018-15686 I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at https://github.com/systemd/systemd/blob/master/docs/CONTRIBUTING.mdsecurity-vulnerability-reports . When system...

Linux systemd Line Splitting Exploit

Linux has an issue with systemd where overlong input to fgets during reexec state injection can lead to line splitting. systemd: reexec state injection: fgets on overlong lines leads to line splitting CVE-2018-15686 I am sending this bug report to Ubuntu, even though it's an upstream bug, as...

Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...

SUSE-SU-2018:2647-1 Security update for nodejs4

This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer bsc1105019 - Upgrade to OpenSSL 1.0.2p, which fixed: - CVE-2018-0732: Client...

CVE-2018-13259

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one...