PT-2019-5540

Name of the Vulnerable Software and Affected Versions Python versions through 3.7.2 Description The issue is related to an uncontrolled resource consumption in the zipfile module of the Python package. This can be exploited by a remote attacker using a malicious ZIP bomb file, leading to a denial...

UBUNTU-CVE-2018-16880

A flaw was found in the Linux kernel's handlerx function in the vhostnet driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the...

XSRF/CSRF vulnerability in phpMyAdmin

PMASA-2018-7 Announcement-ID: PMASA-2018-7 Date: 2018-12-07 Summary XSRF/CSRF vulnerability in phpMyAdmin Description By deceiving a user to click on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages,...

MyBB Group MyBB File Inclusion Vulnerability

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. MyBB Group A file inclusion vulnerability exists in the Admin panel Tools and Maintenance - Task...

MS08-031: Cumulative security update for Internet Explorer

Resolves vulnerabilities including one that could allow remote code execution if a user viewed a specially crafted Web page by using Internet Explorer. Limited accounts on the system could be less affected than administrative accounts.The update that this article describes has been replaced by a...

PT-2018-16625 · Adobe +2 · Flash Player +2

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 28.0.0.161 and earlier Description: The issue is a type confusion vulnerability that could lead to arbitrary code execution in the context of the current user. It allows attackers to execute code remotely...

PT-2018-17534

Name of the Vulnerable Software and Affected Versions Kingsoft WPS Office Free version 10.2.0.5978 Description The issue allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of .pipeWPSCloudSvrWpsCloudSvr, which is described as an...

Intel Issues Updated Spectre Firmware Fixes For Newer Processors

Intel has issued updated microcode to help protect its newer processors from Spectre security exploits. The Santa Clara, Calif.-based company’s new microcode updates – which impact its newer chip platforms, such as Kaby Lake, Coffee Lake, and Skylake – have been released to OEM customers and...

Microsoft Skype DLL Hijacking

Hi @ll, since about two or three years now, Microsoft offers Skype as optional update on Windows/Microsoft Update. JFTR: for Microsoft's euphemistic use of "update" see Once installed, Skype uses its own proprietary update mechanism instead of Windows/Microsoft Update: Skype periodically runs...

PT-2018-5678 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.3.1 Description: The application's input fields accept arbitrary user input, resulting in the execution of malicious JavaScript. It is noted that the vendor disputes this issue, stating it is a feature that enables only a...

PT-2017-12941

Name of the Vulnerable Software and Affected Versions Android versions 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 Description The issue is related to an elevation of privilege vulnerability in the Android system, specifically in the art component. This could potentially allow for unauthorized acce...

HP Integrated Lights-Out (iLO) 4 Multiple Remote Vulnerabilities

HP Integrated Lights-Out iLO 4 is prone to multiple remote vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

NULL pointer deref in event channel poll

ISSUE DESCRIPTION When polling event channels, in general arbitrary port numbers can be specified. Specifically, there is no requirement that a polled event channel ports has ever been created. When the code was generalised from an earlier implementation, introducing some intermediate pointers, a...

PT-2017-18780 · None +1 · Autotrace +1

Name of the Vulnerable Software and Affected Versions: AutoTrace version 0.31.1 Description: The issue is related to a "cannot be represented in type int" problem in the input-tga.c file at line 508:18 of the libautotrace.a library in AutoTrace. Recommendations: For AutoTrace version 0.31.1, at t...

PT-2016-5858 · Red Hat · Red Hat

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue is related to a security problem, but details are not provided. Recommendations: At the moment, there is no information about a newer...

New Relic: Old CAPTCHA offers no protection

To rate-limit users, you use an old CAPTCHA method that has been broken for quite a while due to developments in OCR. There are many services that are available to quickly solve these and so it offers no protection. For example, here is one site that offers easy CAPTCHA breaking:...

PT-2015-1122 · Oracle +6 · Mysql Server +6

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 5.5.42 and earlier Oracle MySQL Server versions 5.6.23 and earlier Description: The issue allows remote authenticated users to affect availability via unknown vectors related to Server: Federated. This can lead to...

FiyoCMS 2.0.1.8 XSS / SQL Injection / URL Bypass

Exploit Title: FiyoCMS Multiple Vulnerabilities Date: 29 March 2015 Exploit Author: Mahendra Vendor Homepage: www.fiyo.org Software Link: http://sourceforge.net/projects/fiyo-cms/ Version: 2.0.1.8, other version might be vulnerable. Tested : Kali Linux 1.0.9a-amd64 CVEs:...

Microsoft Patches FASTFIX on Older Versions of Windows

UPDATE – Microsoft this week patched a vulnerability in the FASTFAT driver that interacts with FAT32 disk partitions, closing a privilege escalation and code execution hole in Windows Server 2003, Windows Vista and Windows Server 2008. But what about Windows 7 and up versions of the OS, you may b...

PT-2013-3891 · Red Hat +1 · Red Hat +1

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue is related to a security problem, but details are not provided. Recommendations: At the moment, there is no information about a newer...