Design/Logic Flaw

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build 1204.77, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code ...

Ashlar Incorporated Ashlar-Vellum Buffer Error Vulnerability

Ashlar Incorporated Ashlar-Vellum is the development platform for Ashlar Incorporated's computer-aided design CAD and 3D modeling software. A security vulnerability exists in Ashlar Incorporated Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12, which stems from a lack of proper...

PT-2023-26946 · Ashlar Vellum · Ashlar-Vellum Cobalt +4

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version 12 SP0 Build 1204.77 Description: The affected applications lack proper validation of user-supplied data when parsing XE files, which could lead to an out-of-bounds write. ...

GHSA-F36P-42JV-8RH2 Lithium vulnerable to Cross Site Scripting in provided Swagger-UI

Impact A XSS vulnerability in the provided outdated Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution RCE and potentially exfiltrate secrets in the context of this swagger session. Patches The used swagger-ui was...

Lithium vulnerable to Cross Site Scripting in provided Swagger-UI

Impact A XSS vulnerability in the provided outdated Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution RCE and potentially exfiltrate secrets in the context of this swagger session. Patches The used swagger-ui was...

CVE-2017-20106

A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...

CVE-2017-20106

A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...

Server side request forgery (ssrf)

A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...

CVE-2017-20106 Lithium Forum Compose Message server-side request forgery

A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...

CVE-2017-20106

The CVE-2017-20106 entry concerns Lithium Forum 2017 Q1. A server-side request forgery (SSRF) vulnerability arises from manipulating the upload_url argument in the Compose Message Handler component. The attack requires local access, and public exploits have been disclosed. Documented impact indic...

CVE-2017-20106 Lithium Forum Compose Message server-side request forgery

A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...

Khoros Forum 代码问题漏洞

Khoros Forum Lithium Forum is a forum system from the US-based Khoros Corporation. A security vulnerability exists in the 2017 Q1 release of Khoros Forum Lithium Forum, which stems from a server-side request forgery vulnerability discovered via the uploadurl parameter...

Xiaomi Mi Mix has an unspecified vulnerability

The Xiaomi Mi Mix is a smartphone from Chinese company Xiaomi Technology Xiaomi. A security vulnerability exists in Xiaomi Mi Mix build fingerprint: Xiaomi/lithium/lithium:6.0.1/MXB48T/7.1.5:user/release-keys in Xiaomi/lithium/lithium:6.0.1/MXB48T/7.1 A security vulnerability exists in...

CVE-2018-3972

An exploitable code execution vulnerability exists in the Levin deserialization functionality of the Epee library, as used in Monero 'Lithium Luna' v0.12.2.0-master-ffab6700 and other cryptocurrencies. A specially crafted network packet can cause a logic flaw, resulting in code execution. An...

CVE-2018-3972

CVE-2018-3972 is a remote code execution vulnerability in the Levin deserialization path of the Monero Epee library. The flaw arises in epee’s Levin deserialization of network packets, where a specially crafted packet can trigger a logic error and remote code execution. The TALOS/Cisco advisory a...

Deserialization of untrusted data

An exploitable code execution vulnerability exists in the Levin deserialization functionality of the Epee library, as used in Monero 'Lithium Luna' v0.12.2.0-master-ffab6700 and other cryptocurrencies. A specially crafted network packet can cause a logic flaw, resulting in code execution. An...

CVE-2018-3972

An exploitable code execution vulnerability exists in the Levin deserialization functionality of the Epee library, as used in Monero 'Lithium Luna' v0.12.2.0-master-ffab6700 and other cryptocurrencies. A specially crafted network packet can cause a logic flaw, resulting in code execution. An...

Dropbox: Stored XSS in dropboxforum.com

This report described a vulnerability where an attacker could put a specially crafted payload into the reply section of threads on dropboxforum.com to bypass the HTML filter on the site. This enabled a stored XSS attack against anyone viewing the message. This was an issue in Lithium forum...

Extending the Airplane Laptop Ban

The Department of Homeland Security is rumored to be considering extending the current travel ban on large electronics for Middle Eastern flights to European ones as well. The likely reaction of airlines will be to implement new traveler programs, effectively allowing wealthier and more frequent...

CVE-2017-1000357

Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight odl-l2switch-switch, which is the feature responsible for the OpenFlow communication. Version: OpenDaylight versions 3.3 Lithium-SR3, 3.4 Lithium-SR4, 4.0...