3216 matches found
Asciidoctor Denial of Service Vulnerability
Asciidoctor is a text processor written in Ruby that supports converting AsciiDoc content to HTML5, DocBook and other formats. A security vulnerability exists in Asciidoctor version 1.5.7.1, which stems from Parsernextblock failing to use the 'while true' statement correctly. A remote attacker ca...
[SECURITY] Fedora 27 Update: audiofile-0.3.6-21.fc27
The Audio File library is an implementation of the Audio File Library from SGI, which provides an API for accessing audio file formats like AIFF/AIFF-C, WAVE, and NeXT/Sun .snd/.au files. This library is used by the EsounD daemon. Install audiofile if you are installing EsounD or you need an API...
GHSA-QW96-MM2G-C8M7 Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page...
CVE-2018-0063
A vulnerability in the IP next-hop index database in Junos OS 17.3R3 may allow a flood of ARP requests, sent to the management interface, to exhaust the private Internal routing interfaces IRIs next-hop limit. Once the IRI next-hop database is full, no further next hops can be learned and existin...
Junos OS: Nexthop index allocation failed: private index space exhausted after incoming ARP requests to management interface
A vulnerability in the IP next-hop index database in Junos OS 17.3R3 may allow a flood of ARP requests, sent to the management interface, to exhaust the private Internal routing interfaces IRIs next-hop limit. Once the IRI next-hop database is full, no further next hops can be learned and existin...
tcpreplay heap buffer overflow vulnerability (CNVD-2018-20537)
Tcpreplay is a set of open source utilities for editing and replaying network traffic for UNIX based operating systems. A heap buffer overflow vulnerability exists in the sendpackets.c file in Tcpreplay version 4.3.0, which stems from the 'getnextpacket' function using the 'memcpy' function in an...
Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
Consider this scenario: Two never-before-seen, heavily obfuscated scripts manage to slip past file-based detection and dynamically load an info-stealing payload into memory. The scripts are part of a social engineering campaign that tricks potential victims into running the scripts, which use the...
IBM Rational Requirements Composer and Rational DOORS Next Generation Cross-Site Scripting Vulnerability
IBM Rational Requirements Composer and Rational DOORS Next Generation RDNG are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. A cross-site scripting vulnerability in IBM Rational...
CVE-2018-1610
IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...
CVE-2018-1610
IBM Rational DOORS Next Generation (RDNG) versions affected: 5.0–5.0.2 and 6.0–6.0.6. The vulnerability is a cross-site scripting flaw in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Root cause details...
Prezi Next Access Bypass Vulnerability
Prezi Next is a presentation editing tool. An access bypass vulnerability exists in Prezi Next version 1.3.101, which can be exploited by attackers to bypass access restrictions...
CVE-2018-17137
Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...
CVE-2018-17137
Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...
Design/Logic Flaw
Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...
CVE-2018-17137
Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SEDEBUGPRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions...
CVE-2018-17137
Prezi Next 1.3.101.11 is affected by an access bypass vulnerability described across multiple sources (e.g., CNVD-2018-19438, NVD CVE-2018-17137). The issue arises from SE_DEBUG_PRIVILEGE on Windows, which could allow attackers to bypass intended access restrictions in the context of HTML5 presen...
Contiki-NG buffer overflow vulnerability (CNVD-2019-09779)
Contiki-NG is an open source cross-platform operating system for next-generation IoT devices. A buffer overflow vulnerability exists in lvmshiftforoperator in os/storage/antelope/lvm.c in Contiki-NG 4.1 and earlier versions when parsing AQL, which can be exploited by an attacker to cause a denial...
Contiki-NG Buffer Over-Read Vulnerability
Contiki-NG is an open source cross-platform operating system for next-generation IoT devices. A buffer over-read vulnerability exists in lookup in os/storage/antelope/lvm.c in Contiki-NG 4.1 and earlier versions when parsing AQL, which can be exploited by an attacker to cause a denial of service...
PT-2018-13750 · Mongodb +3 · Libbson +3
Name of the Vulnerable Software and Affected Versions: libbson version 1.12.0 Description: The issue is related to a heap-based buffer over-read in the bson iter next internal function in bson-iter.c via a crafted bson buffer. Recommendations: For libbson version 1.12.0, at the moment, there is n...