PT-2018-17559

Name of the Vulnerable Software and Affected Versions March Hare WINCVS versions prior to 2.8.01 build 6610 March Hare CVS Suite versions prior to 2009R2 build 6610 Description The issue is related to an Insecure Library Loading vulnerability in the wincvs2.exe or wincvs.exe file. This may allow...

CVE-2018-6461: Untrusted Search Path

March Hare WINCVS before 2.8.01 build 6610, and CVS Suite before 2009R2 build 6610, contains an Insecure Library Loading vulnerability in the wincvs2.exe or wincvs.exe file, which may allow local users to gain privileges via a Trojan horse Python or TCL DLL file in the current working directory...

CVE-2018-6318

The CVE-2018-6318 entry applies to Sophos Tester Tool 3.2.0.7 Beta. The vulnerability is a DLL hijacking flaw where the driver loads a DLL from userland (NTDLL.DLL) without validating the DLL’s signature or hash. An attacker could replace the DLL with a malicious one (locally or via remote access...

CVE-2018-6542

In ZZIPlib 0.13.67, there is a bus error when handling a disk64trailer seek value caused by loading of a misaligned address in the zzipdiskfindfirst function of zzip/mmapped.c...

Code execution vulnerability in DedeCMS backend cache files

Weaving dream content management system DedeCms is a PHP open source website management system. A code execution vulnerability exists in the DedeCMS backend cache file. The vulnerability is due to the system mishandling of input information , allowing an attacker to exploit the vulnerability...

Security Advisory - Arbitrary URL Loading Vulnerability in TripAdvisor

The TripAdvisor app pre-installed in some Huawei mobile phones have an arbitrary URL loading vulnerability due to insufficient input validation and improper configuration. An attacker may exploit this vulnerability to invoke TripAdvisor to load a specific URL and execute malicious code contained ...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2018-02236)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 58, where the Developer Tools panel in an extension is used to load URLs, but the program does not enforce this process in al...

Cisco NX-OS Cryptographic Signature Bypass

The vulnerability of the NX-OS operating system of the Cisco Unified Computing System Central device management system is related to incorrect verification of the cryptographic signature of data. Exploiting this vulnerability could allow an attacker to bypass the signature verification and downlo...

CVE-2017-12632

A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate...

PT-2018-5437

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions prior to 1.5.0 Description: A malicious host header in an incoming HTTP request could cause Apache NiFi to load resources from an external server. Recommendations: For versions prior to 1.5.0, upgrade to Apache NiFi 1.5.0...

CVE-2017-12632: Improper Input Validation

A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate...

UBUNTU-CVE-2018-5118

The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites. An issue was discovered where the page could attempt to create these images through "file:" URLs from the local file system. This loading is blocked by the...

OpenJDK: GTK library loading use-after-free (AWT, 8185325)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

Fedora 27 : pure-ftpd (2017-abb54caee2)

This is an update fixing loading the configuration file. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Updated kernel packages fix security vulnerabilities

This kernel update is based on the upstream 4.14.13 and fixes several security issues. The most important fix in this update is for the security issue named "Meltdown" that is fixed in theese kernels by enabling kernel Page Table Isolation KPTI. Note that according to AMD, this issue does not...

imalib2 GIF Loader DoS Confidential Data

The vulnerability of the imlib2 GIF library loader exists due to a read buffer overflow error. Exploiting this vulnerability can allow an attacker to cause service failures or gain access to confidential data using a specially created GIF image...

Blender BKE_image_acquire_ibuf Integer Overflow Code Execution Vulnerability

Summary An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the...

Blender Sequencer imb_load_dpx_cineon Integer Overflow Code Execution Vulnerability

Summary An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .cin file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the...

Mautic Load Page Cross-Site Scripting Vulnerability

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in the Mautic loading page in Mautic versions 2.1.0 through 2.11.0. A remote attacker can exploit the...

CVE-2017-1000424: Undefined Security Weakness

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...