CVE-2018-7843

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus...

Out-of-bounds

A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus...

CVE-2018-7844

A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus...

CVE-2018-7856

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus...

CVE-2018-7853

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus...

CVE-2018-7843

CVE-2018-7843 concerns Schneider Electric Modicon PLCs (M580, M340, Quantum, Premium) with a flaw in the UMAS memory block read path over Modbus. The public Talos analysis describes an out-of-bounds memory read in the MEMORY_BLOCK_READ function that can trigger a non-recoverable fault, potentiall...

CVE-2018-7843

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus...

Microsoft Windows Secondary Logon Denial of Service (MS16-046: CVE-2016-0135)

A remote denial of service vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way Windows handles memory blocks while using the LSARPC protocol. A remote attacker can exploit this issue by enticing the victim to open a specially crafted file...

PHP unserialize() Use-After-Free Vulnerabilities

Exploit for php platform in category dos / poc Use After Free Vulnerabilities in unserialize Taoguang Chen Write Date: 2015.7.31 Release Date: 2015.9.4 Multiple use-after-free vulnerabilities were discovered in unserialize with Serializable class that can be abused for leaking arbitrary memory...

PHP 5.6 / 5.5 / 5.4 SplOnjectStorage unserialize() Use-After-Free

Yet Another Use After Free Vulnerability in unserialize with SplObjectStorage Taoguang Chen - Write Date: 2015.8.27 - Release Date: 2015.9.4 A use-after-free vulnerability was discovered in unserialize with SplObjectStorage object's deserialization and crafted object's wakeup magic method that ca...

PHP unserialize() Use-After-Free

Use After Free Vulnerability in unserialize Taoguang Chen - Write Date: 2015.2.3 - Release Date: 2015.3.20 A use-after-free vulnerability was discovered in unserialize with a specially defined object's wakeup magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary...

PHP DateTimeZone Type Confusion Infoleak

Type Confusion Infoleak Vulnerability in unserialize with DateTimeZone Taoguang Chen - Write Date: 2015.1.29 - Release Date: 2015.2.20 A Type Confusion Vulnerability was discovered in unserialize with DateTimeZone object's wakeup magic method that can be abused for leaking arbitrary memory blocks...

Cisco ASA SSL VPN Memory Blocks Exhaustion DoS (CSCuq68888)

According to its banner, the version of the Cisco ASA software on the remote device is affected by a vulnerability in the SSL VPN feature due to improper implementation of memory blocks allocation when processing crafted HTTP packets. A remote, unauthenticated attacker can exploit this issue by...

Apache APR and APR-util Multiple Integer Overflow Vulnerabilities

The host is installed with Apache APR and APR-Util and is prone to multiple Integer Overflow vulnerabilities. OpenVAS Vulnerability Test $Id: gbapacheaprnaprutiliofvuln.nasl 6516 2017-07-04 12:20:47Z cfischer $ Apache APR and APR-util Multiple Integer Overflow Vulnerabilities Authors: Antu Sanadi...

GlobalLink 2.7.0.8 - 'glItemCom.dll SetInfo()' Heap Overflow

document.write""; var heapSprayToAddress = 0x0c0c0c0c; var shellcode = unescape "%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090" + // exec calc "%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%uf513" + "%ue2ce%u8369%ufceb%uf4e2%u2609%u69a6%ucef5%u2c69" +...

Microsoft DXMedia SDK 6 (SourceUrl) ActiveX Remote Code Execution

Exploit for unknown platform in category remote exploits ================================================================= Microsoft DXMedia SDK 6 SourceUrl ActiveX Remote Code Execution ================================================================= Tested on:.. - Microsoft DirectX Media 6.0 S...