The vulnerability of Qualcomm’s TrustZone microprogramming software technology allows a intruder to trigger a service failure or exert other effects on the system.

The vulnerability of the TrustZone technology a part of the DRM subsystem of Qualcomm’s Secure Execution Environment for Android, as provided in the CAF repository, is due to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to cause a system failure or exert...

The vulnerability of Qualcomm’s TrustZone microprogramming software technology, which allows attackers to circumvent existing access control policies.

The vulnerability of Qualcomm’s TrustZone microprogramming software lies in a numerical overflow condition that causes an operation to escape outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to bypass existing access control policies...

Privilege Escalation

github.com/opencontainers/runc is vulnerable to privilege escalation attacks. These attacks are possible because github.com/opencontainers/runc treats a numeric UID as a potential username. This allows local users to gain privileges though a numeric username in the password file. This transitivel...

The vulnerabilities of programs for viewing and editing PDF files such as Adobe Reader, Adobe Acrobat, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud allow attackers to execute arbitrary code.

The vulnerability of CCITT programs for viewing and editing PDF files, such as Adobe Reader, Adobe Acrobat, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud, is due to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

CVE-2017-5063

A numeric overflow in Skia in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

Updated python-django packages fix security vulnerability

It was discovered that Django incorrectly handled numeric redirect URLs. A remote attacker could possibly use this issue to perform XSS attacks, and to use a Django server as an open redirect. CVE-2017-7233 Phithon Gong discovered that Django incorrectly handled certain URLs when the...

Open Redirect And Cross-site Scripting (XSS)

django is vulnerable to open redirect and cross-site scripting XSS attacks.The library's security check for redirects considers certain numeric URLs as safe, allowing a malicious user to cause an open redirect or cross-site scripting attack via URL linking...

USN-3254-1 python-django vulnerabilities

It was discovered that Django incorrectly handled numeric redirect URLs. A remote attacker could possibly use this issue to perform XSS attacks, and to use a Django server as an open redirect. CVE-2017-7233 Phithon Gong discovered that Django incorrectly handled certain URLs when the...

django -- multiple vulnerabilities

Django team reports: These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible. Open redirect and possible XSS attack via user-supplied numeric redirect URLs Open redirect vulnerability in django.views.static.serve...

DEBIAN-CVE-2017-1001000

The registerroutes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a...

The vulnerability of the console-based graphic editor ImageMagick, which allows a hacker to trigger a service failure

The vulnerability of the console-based graphic editor ImageMagick is caused by a numerical overflow. Exploiting this vulnerability allows an attacker, operating remotely, to cause a service failure termination of the application by sending large input data...

The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure

The vulnerability of the emulatedapdufromguest function in the usb/dev-smartcard-reader.c file of the QEMU hardware emulation software, which supports emulation of CCID Card devices, is caused by a numerical overflow. Exploiting this vulnerability could allow an attacker, operating locally, to...

Fedora 25 : python-peewee (2017-b3b65a20c4)

Backport upstream fix to force limit and offset to be numeric Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

GLSA-201612-28 : Docker: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201612-28 Docker: Privilege escalation Docker does not properly distinguish between numeric UIDs and string usernames. Impact : Local attackers could possibly escalate their privileges. Workaround : There is no known workaround at...

tso-brute NSE Script

TSO account brute forcer. This script relies on the NSE TN3270 library which emulates a TN3270 screen for NMAP. TSO user IDs have the following rules: - it cannot begin with a number - only contains alpha-numeric characters and @, , $. - it cannot be longer than 7 chars Script Arguments...

UBUNTU-CVE-2016-9375

In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation was successful...

SQL Injection Vulnerability in Nine to Five Network Website Building System

Ninety-five Network Building System is a general-purpose CMS system. The product has SQL injection vulnerability, vulnerability URL: http://target/News.asp?newskind= The vulnerability parameter is newskind , type is GET injection, numeric injection, the attacker can use the vulnerability to obtai...

SecNews: Querying private posts and changing post meta

Summary --- Unauthenticated user can run arbitrary post queries and insert arbitrary numeric post meta via vulnerable /wp-content/themes/SecNews-NewCustom/functions/ajax.php file. I'm including two exploits in one report because the fix for both is the same, i.e. delete ajax.php. Run arbitrary po...

Knight CMS Talent System v3.7 has SQL Injection Vulnerabilities

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS Talent System v3.7 suffers from a SQL injection vulnerability due to numeric variable filtering being missed resulting in injection, allowing remote attackers to exploit the vulnerability by submitting special...

The vulnerability of the Android operating system, which allows a hacker to circumvent existing access restrictions

The vulnerability of the function in app/aboot/aboot.c of the Qualcomm Android operating system is caused by a numerical overflow. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions using specially crafted values...