Esri ArcReader PMF File Parsing Uninitialized Pointer Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Esri ArcReader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PMF...

The vulnerability of the Samba networking communication package, related to pointer arithmetic errors, allows a hacker to trigger a service failure.

The vulnerability of the Samba networking communication package is related to errors in pointer manipulation. Exploiting this vulnerability can allow a remote attacker to cause service failures...

CVE-2021-22548

An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommended to update past 0.6.2 or git commit...

CVE-2021-22550

An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c...

CVE-2020-14392

An untrusted pointer dereference flaw was found in Perl-DBI 1.643. A local attacker who is able to manipulate calls to dbddblogin6sv could cause memory corruption, affecting the service's availability...

The vulnerability of Samba software, related to pointer manipulation errors, allows a hacker to trigger a service failure in the AD, DC, or LDAP server.

The vulnerability of Samba software is related to errors in pointer manipulation. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause a failure in the service of the AD, DC, or LDAP servers...

The vulnerability of the LDAP dirsync component in the Samba networking software allows a hacker to induce a service failure.

The vulnerability of the LDAP dirsync component in the Samba networking software package involves a pointer manipulation issue. Exploiting this vulnerability could allow an attacker to cause service failures...

Valve: OOB reads in network message handlers leads to RCE

Vulnerability In Source engine games there are many network messages sent from the server to the client that take an entity index. There is a common pattern among many of these messages for the lower bounds of the entity index to be checked but not the upper bounds. In many cases these out of bou...

Code injection

Huawei S5700 and S6700 have a DoS security vulnerability. Attackers with certain permissions perform specific operations on affected devices. Because the pointer in the program is not processed properly, the vulnerability can be exploited to cause the device to be abnormal...

The vulnerability of the gtbl document editing tool from the groff package, related to errors in pointer arithmetic, allows a perpetrator to trigger a service failure.

The vulnerability of the gtbl document editing tool from the groff package is related to errors in pointer manipulation at address 0x0000000000409400. Exploiting this vulnerability could allow an attacker to cause a service failure by passing a specially crafted file as an argument to the command...

Foxit Reader PDF Parsing addAnnot Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF...

The vulnerability of the ext4_fill_super function in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ext4fillsuper function fs/ext4/super.c in the Linux operating system is related to a pointer manipulation error. Exploiting this vulnerability can allow an attacker, acting remotely, to cause a service failure by using a specially crafted version of the ext4 file system...

The vulnerability of the sixeldecode function (coder/sixel.c) in the console-based graphic editor ImageMagick, which allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sixeldecode function coder/sixel.c in the console-based image editing tool ImageMagick is related to pointer manipulation errors. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

Apple macOS/iOS - NSUnarchiver Heap Corruption Due to Lack of Bounds Checking in [NSBuiltinCharacterSet initWithCoder:]

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1170 Via NSUnarchiver we can read NSBuiltinCharacterSet with a controlled serialized state. It reads a controlled int using decodeValueOfObjCType:"i" then either passes it to CFCharacterSetGetPredefined or uses it directly to...

Microsoft Windows 7 / 2008 R2 (x64) - EternalBlue SMB Remote Code Execution (MS17-010) Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python from impacket import smb from struct import pack import os import sys import socket ''' EternalBlue exploit for Windows 7/2008 by sleepya The exploit might FAIL and CRASH a target system depended on what is overwritten Test...

Oracle Outside In Technology PDF parser confusion Code Execution Vulnerability

Summary An exploitable arbitrary write vulnerability exists in the PDF parser functionality of Oracle Outside In Technology SDK. A specially crafted PDF document can cause a parser confusion resulting in an arbitrary write vulnerability ultimately leading to code execution. Tested Versions Oracle...

Microsoft Edge - JSON.parse Info Leak

Microsoft Edge - JSON.parse Info Leak var once = false; var a = 1; function f if!once a = new Array1, 2, 3; this2 = a; once = true; //alert"f " + this; return ; JSON.parse"1, 2, 4, 5", f; var n = new Numbera0; n = n 1; var s = n.toString16; n = new Numbera1; n = n 1; s = s + n.toString16; n.lengt...

Microsoft Edge CTreePos Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw relates to how Edge handles tex...

Tor: potential memory corruption in or/buffers.c (particularly on 32 bit)

In or/buffer.s.c: c / Return the allocation size we'd like to use to hold target bytes. / static inline sizet preferredchunksizesizet target sizet sz = MINCHUNKALLOC; while CHUNKSIZEWITHALLOCsz include define FLEXIBLEARRAYMEMBER // define DEBUGCHUNKALLOC / A single chunk on a buffer. / typedef...

Microsoft Office Excel Binary Worksheet Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...