CVE-2020-17479

jpv aka Json Pattern Validator before 2.2.2 does not properly validate input, as demonstrated by a corrupted array...

CVE-2020-17479

CVE-2020-17479 affects jpv (Json Pattern Validator) prior to version 2.2.2. The issue is due to improper input validation, demonstrated by a corrupted array. Documented impact remains high (per CVSS data in the initial entry), but no exploitation details are provided within the supplied materials...

GHSA-WHRH-9J4Q-G7PH CSRF Vulnerability in polaris-website

Impact CSRF vulnerability: In some very specific circumstances, an attacker would be able to update your settings. Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your...

CSRF Vulnerability in polaris-website

Impact CSRF vulnerability: In some very specific circumstances, an attacker would be able to update your settings. Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your...

[SECURITY] Fedora 32 Update: mutt-1.14.5-1.fc32

Mutt is a small but very powerful text-based MIME mail client. Mutt is highly configurable, and is well suited to the mail power user with advanced features like key bindings, keyboard macros, mail threading, regular expression searches and a powerful pattern matching language for selecting group...

Cross-Site Scripting (XSS)

github.com/astaxie/beego/issues is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the Router Pattern...

The vulnerability of the /Pattern component of the Nitro Pro application for reading and editing PDF files, which allows a hacker to execute arbitrary code.

The vulnerability of the Nitro Pro PDF reading and editing application’s /Pattern component is related to a numerical overflow in the memory buffer. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially crafted PDF file...

PCRE2: Denial of service

Background PCRE2 is a project based on PCRE Perl Compatible Regular Expressions which has a new and revised API. Description PCRE2 has a flaw when handling JIT-compiled regex using the \X pattern. Impact An attacker could cause a possible Denial of Service condition. Workaround There is no known...

Cisco IOS Software Secure Shell DoS (cisco-sa-ssh-dos-Un22sd2A)

According to its self-reported version, IOS is affected by a vulnerability in the Secure Shell SSH server code due to an internal state not being represented correctly in the SSH state machine, which leads to an unexpected behavior. An authenticated, remote attacker can exploit this, by creating ...

StreamRipper32 2.6 - Buffer Overflow

StreamRipper32 version 2.6 buffer overflow proof of concept exploit. Exploit Title: StreamRipper32 2.6 - Buffer Overflow PoC Date: 2020-05-14 Exploit Author: Andy Bowden Tested On: Win10 x64 Download Link: http://streamripper.sourceforge.net/sr32/StreamRipper3226.exe Vendor Page:...

The vulnerability of the SplashOutputDev::tilingPatternFill function (SplashOutputDev.cc), a library for displaying PDF files in Poppler, allows a hacker to trigger a service failure.

The vulnerability of the SplashOutputDev::tilingPatternFill function SplashOutputDev.cc, which is part of the Poppler PDF rendering library, is related to division by zero errors. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2020-6092

An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects. A specially crafted PDF file can trigger an integer overflow that can lead to arbitrary code execution. In order to trigger this vulnerability, victim must open a malicious file...

Nitro Pro PDF Pattern Object Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects. A specially crafted PDF file can trigger an integer overflow that can lead to arbitrary code execution. In order to trigger this vulnerability, victim must open a malicious file...

Geeklog 2.2.1 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Cross-Site Scripting Vulnerability in Geeklog Affected Software: Geeklog Affected Versions: 2.2.1 Vendor Homepage: https://www.geeklog.net/ Vulnerability Type: Cross-Site Scripting Severity: Important Status: Fixed CVSS Score 3.0: 7.4...

Denial Of Service (DoS)

vsftpd is vulnerable to denial of service DoS. The vulnerability exists as a flaw was discovered in the way vsftpd processed file name patterns. An FTP user could use this flaw to cause the vsftpd process to use an excessive amount of CPU time, when processing a request with a specially-crafted...

CVE-2019-13224

A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte...

jetty: full server path revealed when using the default Error Handling

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

Trend Micro Malware Sample Detection Bypass Vulnerability (1118797)

The remote host is running a version of the Trend Micro engine with an outdated pattern file. It is, therefore, affected by an issue whereby certain malware samples may, incorrectly, be classified as benign. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid134892;...

CVE-2019-16065

A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user...

Design/Logic Flaw

The GNU C Library aka glibc or libc6 before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to...