Code injection in ansible

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

GHSA-C2W9-48QC-QPJ4 Code injection in ansible

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

Mozilla Firefox WebExtensions Identity Launch WebAuth Flow Unauthorized Access

The vulnerability of the browser identity.launchWebAuthFlow function in Mozilla Firefox’s WebExtensions extensions is related to the improper loading of content via HTTPS. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Query Windows Machine for RAM Artifacts: memtriage

Allows you to quickly query a live Windows machine for RAM artifacts. This tool utilizes the Winpmem drivers to access physical memory, and Volatility for analysis. Caveats: Doesn’t work with Device Guard enabled. Should be tested on machines before deploying. Example Usage usage: memtriage.exe -...

CVE-2018-1487: Untrusted Search Path

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972...

PT-2018-12771

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1 Description The issue allows low privilege users to potentially gain full access to the DB2 instance account by loading a malicious shared...

Memory Read Out-of-Bounds Vulnerability in TAS TP03-Software V21

The TP03-Software V21 is a programmable controller. A memory read out-of-bounds vulnerability exists in TP03-Software V21. The vulnerability is caused due to TP03-Software failing to validate the availability of a function's pointer when reading a malformed project, which can be exploited by an...

CVE-2018-5885

While loading dynamic fonts, a buffer overflow may occur if the number of segments in the font file is out of range in Snapdragon Mobile and Snapdragon Wear...

The installers of multiple Logicool software programs may insecurely load Dynamic Link Libraries

Overview The installers of multiple software programs provided by Logicool Co. Ltd contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427 . Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinat...

Unspecified vulnerability in PyYAML

PyYAML is a next-generation YAML parser based on Python. A security vulnerability exists in PyYAML versions prior to 4.1, which stems from the program not using the 'yaml.safeload' function. An attacker can exploit this vulnerability to execute arbitrary code...

Installer of Glary Utilities may insecurely load Dynamic Link Libraries

Overview Installer of Glary Utilities provided by Glarysoft Ltd. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

CVE-2018-13043

scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing...

Code injection

scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing...

CVE-2018-13043

scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing...

DEBIAN-CVE-2018-13043

scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing...

CVE-2018-13043

CVE-2018-13043 affects Debian devscripts up to 2.18.3, where scripts/grep-excuses.pl loads YAML unsafely (YAML::Syck without blessing), enabling code execution. Other advisories (Ubuntu USN-3704-1, Fedora updates) reference the same issue and indicate fixes to devscripts 2.18.4. The vulnerability...

CVE-2018-13043

scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing...

UBUNTU-CVE-2018-13043

scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing...

CVE-2018-13043: Improper Control of Generation of Code

scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing...

PT-2018-11557

Name of the Vulnerable Software and Affected Versions devscripts versions through 2.18.3 Description The issue allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing. This is related to the scripts/grep-excuses.pl in...