CVE-2018-12805

Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation...

CVE-2018-12805

Adobe Connect 9.7.5 and earlier are affected by an Insecure Library Loading vulnerability (CVE-2018-12805) in the Add-in Installer, where insecure DLL loading could be abused to escalate local privileges. Connected advisories note this is part of APSB18-22, which also covers other issues in Conne...

CVE-2018-12805: Uncontrolled Search Path Element

Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation...

PT-2018-11401

Name of the Vulnerable Software and Affected Versions Adobe Connect versions 9.7.5 and earlier Description The issue is related to Insecure Library Loading, which could lead to privilege escalation if successfully exploited. Recommendations For Adobe Connect versions 9.7.5 and earlier, update to ...

GHSA-M85C-9MF8-M2M6 Unsafe deserialization in confire

An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An...

GHSA-GCR6-RF47-JRGF Loaded Databook of Tablib prone to python insertion resulting in command execution

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability...

Unsafe deserialization in owlmixin

An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file aka loadyaml or loadyamlf can execute arbitrary Python commands resulting in command execution because load is used where safeload should have been used. An...

GHSA-CCMQ-QVCP-5MRM Unsafe deserialization in owlmixin

An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file aka loadyaml or loadyamlf can execute arbitrary Python commands resulting in command execution because load is used where safeload should have been used. An...

GHSA-C2W9-48QC-QPJ4 Code injection in ansible

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

Code injection in ansible

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

Mozilla Firefox WebExtensions Identity Launch WebAuth Flow Unauthorized Access

The vulnerability of the browser identity.launchWebAuthFlow function in Mozilla Firefox’s WebExtensions extensions is related to the improper loading of content via HTTPS. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Query Windows Machine for RAM Artifacts: memtriage

Allows you to quickly query a live Windows machine for RAM artifacts. This tool utilizes the Winpmem drivers to access physical memory, and Volatility for analysis. Caveats: Doesn’t work with Device Guard enabled. Should be tested on machines before deploying. Example Usage usage: memtriage.exe -...

CVE-2018-1487: Untrusted Search Path

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972...

PT-2018-12771

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1 Description The issue allows low privilege users to potentially gain full access to the DB2 instance account by loading a malicious shared...

Memory Read Out-of-Bounds Vulnerability in TAS TP03-Software V21

The TP03-Software V21 is a programmable controller. A memory read out-of-bounds vulnerability exists in TP03-Software V21. The vulnerability is caused due to TP03-Software failing to validate the availability of a function's pointer when reading a malformed project, which can be exploited by an...

CVE-2018-5885

While loading dynamic fonts, a buffer overflow may occur if the number of segments in the font file is out of range in Snapdragon Mobile and Snapdragon Wear...

The installers of multiple Logicool software programs may insecurely load Dynamic Link Libraries

Overview The installers of multiple software programs provided by Logicool Co. Ltd contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427 . Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinat...

Unspecified vulnerability in PyYAML

PyYAML is a next-generation YAML parser based on Python. A security vulnerability exists in PyYAML versions prior to 4.1, which stems from the program not using the 'yaml.safeload' function. An attacker can exploit this vulnerability to execute arbitrary code...

Installer of Glary Utilities may insecurely load Dynamic Link Libraries

Overview Installer of Glary Utilities provided by Glarysoft Ltd. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

Code injection

scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing...