CVE-2017-14520

In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd in Splash.cc, which may lead to a potential attack when handling malicious PDF files...

OPENSUSE-SU-2017:2482-1 Security update for chromium

This update for chromium to version 61.0.3163.79 fixes several issues. These security issues were fixed: - CVE-2017-5111: Use after free in PDFium boo1057364. - CVE-2017-5112: Heap buffer overflow in WebGL boo1057364. - CVE-2017-5113: Heap buffer overflow in Skia boo1057364. - CVE-2017-5114: Memo...

ALPINE-CVE-2017-14040

An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact...

CVE-2017-8261

In all Qualcomm products with Android releases from CAF using the Linux kernel, in a camera driver ioctl, a kernel overwrite can potentially occur...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2142-1)

The SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to the following security updates : - CVE-2017-1000111: fix race condition in net-packet code that could be exploited to cause out-of-bounds memory access bsc1052365. - CVE-2017-1000112: fix race condition in net-packet code that could ha...

Tor: Access to local file system using javascript

Issue : Access to local file system using javascriptslightly xss on server side The browser can access the local files using iframes with a local html file. this is very normal and often used for local web development but javascript shouldn't be able to get the content of that iframe because this...

Security Analysis with SonarQube Plugin

SonarQube Figure 1: The SonarQube dashboard lists security vulnerabilities detected by RIPS code analysis. Global organizations use SonarQube to concentrate different quality analysis tools in one place for easy management, maintenance, and learning potential of findings. Seasoned developers are...

WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice

Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm, exec-lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if UNLIKELY!result...

CVE-2017-11654

An out-of-bounds read and write flaw was found in the way SIPcrack 0.2 processed SIP traffic, because 0x00 termination of a payload array was mishandled. A remote attacker could potentially use this flaw to crash the sipdump process by generating specially crafted SIP traffic...

CVE-2017-7480

rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution...

graphite2: assertion error "size() > n"

An assertion error has been reported in graphite2. An attacker could possibly exploit this flaw to cause an application crash...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

Cross site scripting

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-5394

CVE-2016-5394 concerns the Apache Sling XSS Protection API. The XSSProtection API module, before version 1.0.12, uses the encoding from XSSAPI.encodeForJSString() that is not sufficiently restrictive, allowing certain input patterns to pass unencoded and potentially enable cross-site scripting. T...

CVE-2017-9339

A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

Cross site scripting

PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping of data stealing data...

ExpressionEngine: Image lib - unescaped file path

Under ./system/ee/legacy/libraries/Imagelib.php There are function from CodeIgniter to manipulate images. The issue is that the PHP function exec is used two times in two different functions: imageprocessimagemagick and imageprocessnetpbm In both cases the fullsrcpath and fulldstpath are given...

CVE-2017-1000072

Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravityvalue resulting potentially leading to modification of unexpected memory locations...

CVE-2017-10972

Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server...