CVE-2017-16198

ritp is a static web server. ritp is vulnerable to a directory traversal issue whereby an attacker can gain access to the file system by placing ../ in the URL. Access is restricted to files with a file extension, so files such as /etc/passwd are not accessible...

DEBIAN-CVE-2018-11319

Syntastic aka vim-syntastic through 3.9.0 does not properly handle searches for configuration files it searches the current directory up to potentially the root. This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a...

Fedora 26 : knot-resolver (2018-0c0671072b)

Knot Resolver 2.3.0 2018-04-23 ================================ Security -------- - fix CVE-2018-1110: denial of service triggered by malformed DNS messages !550, !558, security!2, security!4 - increase resilience against slow lorris attack security!5 Bugfixes -------- - validation: fix SERVFAIL ...

Directory Traversal

superstatic is vulnerable to directory traversal. The attack exists because it does not check the decoded path has..\ which allow traversal to parent directories in Windows...

Mozilla: Out-of-bounds write with malformed IPC messages (MFSA 2018-07)

A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird 52.7, Firefox ESR 52.7, and Firefox 59...

Mozilla: Out-of-bounds write with malformed IPC messages (MFSA 2018-07)

A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird 52.7, Firefox ESR 52.7, and Firefox 59...

Sql injection

SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parentmodule/parentlogin.php...

CVE-2018-7477

SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parentmodule/parentlogin.php...

CVE-2018-7477

SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parentmodule/parentlogin.php...

CVE-2018-7477

SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parentmodule/parentlogin.php...

phpbb3 -- multiple issues

phpbb developers reports: Password updater working with PostgreSQL - The cron for updating legacy password hashes was running invalid queries on PostgreSQL. Deleting orphaned attachments w/ large number of orphaned attachments - Orphaned attachment deletion was improved to be able to delete them...

Directory Traversal

websockify is vulnerable to directory traversal attacks. The vulnerability exists as it does not resolve the given absolute path to check if the resource is within the parent's scope...

Security Updates for Internet Explorer (September 2017)

The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when affected Microsoft scripting engines do not properly handle objects in memory. The vulnerability could...

CVE-2017-15527

Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there is insufficient security validation / sanitization of user-supplied input file names, such that characters representing "traverse to pare...

High severity vulnerability that affects electron

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line...

UBUNTU-CVE-2017-7089

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via a crafted web site that is mishandl...

Webkit (Safari) - Universal Cross-site Scripting

function Pewvar doc=open'parent-tab://apple.com';doc.document.body.innerHTML='';Click me! Exploit by Frans Rosén html data:text/html,function yx=open'parent-tab://google.com','top',x.document.body.innerHTML='';setTimeouty,100 -- function...

CVE-2017-8736

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to obtain specific information used in the...

DEBIAN-CVE-2017-12938

UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file...

Microsoft Edge Chakra EmitAssignment Register Issue Exploit

Microsoft Edge Chakra has an issue where EmitAssignment uses the "this" register without initializing. Microsoft Edge: Chakra: EmitAssignment uses the "this" register without initializing "EmitAssignment" doesn't call "EmitSuperMethodBegin" that initializes the "this" register for the case when t...