CVE-2016-6809

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization...

Groovy: Remote code execution via deserialization

It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization an...

CVE-2017-2445

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

Design/Logic Flaw

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

CVE-2017-2445

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

CVE-2017-2445

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

CVE-2017-2445

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

Shopify: XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app

This report is similar in impact, exploitability and root-cause as report 205701 requiring an additional step of user-interaction. Description The Shopify Embedded App SDK is used to facilitate limited interactions with parent page /admin/apps/$id from an embedded app within the shop admin...

UBUNTU-CVE-2017-2445

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

PT-2017-1665

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.3 Safari versions prior to 10.1 tvOS versions prior to 10.2 Description The issue involves the WebKit component and allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects. This can...

CVE-2017-2445

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

Null pointer dereference

Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service NULL pointer dereference or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be...

CVE-2017-7374

CVE-2017-7374 is a use-after-free in the Linux kernel fs/crypto/ subsystem prior to 4.10.7, where revoking keyring keys used for ext4, f2fs, or ubifs encryption can free cryptographic transform objects prematurely. This enables local attackers to cause a denial of service via a NULL pointer deref...

CVE-2017-7374

Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service NULL pointer dereference or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be...

UBUNTU-CVE-2014-9804

vision.c in ImageMagick allows remote attackers to cause a denial of service infinite loop via vectors related to "too many object."...

DEBIAN-CVE-2014-9804

vision.c in ImageMagick allows remote attackers to cause a denial of service infinite loop via vectors related to "too many object."...

PT-2017-6397 · Imagemagick · Imagemagick

Name of the Vulnerable Software and Affected Versions: ImageMagick affected versions not specified Description: The issue allows remote attackers to cause a denial of service, resulting in an infinite loop. This is related to vectors involving "too many object" in the vision.c file of ImageMagick...

CVE-2016-9469: Exposed Dangerous Method or Function

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix...

CVE-2016-9167: Undefined Security Weakness

NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL...

PT-2017-9981

Name of the Vulnerable Software and Affected Versions Novell eDirectory versions prior to 9.0.2 Description The issue concerns a problem with calculating ACLs on LDAP objects across partition boundaries, potentially leading to a privilege escalation. This could occur by modifying user attributes...