CVE-2020-28596

A stack-based buffer overflow vulnerability exists in the Objparser::objparse functionality of Prusa Research PrusaSlicer 2.2.0 and Master commit 4b040b856. A specially crafted obj file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2020-28596

PrusaSlicer 2.2.0 and Master (commit 4b040b856) are affected by a stack-based buffer overflow in ObjParser::objparse(). A fixed-size stack buffer (buf) is fed by fread in a loop, with insufficient bounds checking, enabling potential code execution via a crafted .obj file. The vulnerability is evi...

CVE-2020-28596: Out-of-bounds Write

A stack-based buffer overflow vulnerability exists in the Objparser::objparse functionality of Prusa Research PrusaSlicer 2.2.0 and Master commit 4b040b856. A specially crafted obj file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

Prototype Pollution in tandrewnichols/safe-obj

Description safe-obj is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js var safeObj = require"safe-obj" var obj = ; console.log"Before: " + .polluted safeObj.expandobj, "proto.polluted", true console.log"After: " + .polluted 2. Execute th...

PT-2021-11565 · Prusa +1 · Prusaslicer +1

Name of the Vulnerable Software and Affected Versions: PrusaSlicer versions 2.2.0 and Master commit 4b040b856 Description: An out-of-bounds write issue exists in the load obj functionality of the Obj.cpp file. This can be triggered by a specially crafted obj file, potentially leading to code...

Prototype Pollution in ionicabizau/obj-def

Description obj-def is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var objDef = require"obj-def" var obj = console.log"Before : " + .polluted; objDefobj, "proto", .polluted ='Yes! Its Polluted'; console.log"After : " + .polluted; 2. Execute the...

Prototype Pollution in ionicabizau/obj-unflatten

Description obj-unflatten convert flatten objects in nested ones. This package is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js const unflatten = require'obj-unflatten' console.log'Before: ' + .polluted unflatten'proto.polluted':...

Blog2Social <= 5.0.0 - PHP Obj Injection

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin was affected by a PHP Obj Injection security vulnerability...

Double free

dwgdecodeeed in decode.c in GNU LibreDWG before 0.6 leads to a double free in dwgfreeeed in free.c because it does not properly manage the obj-eed value after a free occurs...

CVE-2018-14524

dwgdecodeeed in decode.c in GNU LibreDWG before 0.6 leads to a double free in dwgfreeeed in free.c because it does not properly manage the obj-eed value after a free occurs...

CVE-2018-13622

The mintToken function of a smart contract implementation for ObjectToken OBJ, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13222: Integer Overflow or Wraparound

The sell function of a smart contract implementation for ObjectToken OBJ, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-1000042

Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web reques...

CVE-2018-1000042: Improper Neutralization of Special Elements used in an OS Command

Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web reques...

PT-2017-3915

Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.3 Description The issue is related to a buffer over-read in the rsvp obj print function in print-rsvp.c of the tcpdump utility. This can allow a remote attacker to cause a denial of service or potentially gain...

Post Pay Counter < 2.731 - PHP Obj Injection & Access Control Issues

The Post Pay Counter WordPress plugin was affected by a PHP Obj Injection & Access Control Issues security vulnerability...

PYSEC-2017-64

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

UBUNTU-CVE-2016-7147

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

Jenkins-LDAP (CVE-2016-9299) deserialization vulnerability analysis-vulnerability warning-the black bar safety net

Source: gone with the wind's Blog Author: iswin This vulnerability in the last 11 month of official release announcement when I was concerned too, when he was looking for com. sun. jndi. ldap. LdapAttribute this class related to the deserialization was aware of this category inside the...

Microsoft Excel - OBJ Record Stack Overflow

No description provided by source. ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub-24-microsoft-excel-obj-record-stack-overflow/ http://www.exploit-db.com/sploits/moaub-24-excel-exploit.zip...