CVE-2019-9791

The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time JIT compiler and when the constructor function is entered through on-stack replacement OSR. This allows for possible arbitrary...

RSA Wrap Up: It’s All About The People

RSA 2019 just finished and -- as always -- what a week it was. This year was a personal milestone for me, with the week culminating in my presentation with Gary Hayslip, CISO at WebRoot, titled: “Why the Role of the CISO Sucks and What We Should Do about It.” But, before we get to Friday morning ...

CVE-2019-9761

CVE-2019-9761 is an XXE vulnerability in PHPSHE 1.7. The issue arises from the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php, allowing an unauthenticated attacker to read arbitrary files or scan internal networks. CVSS details (NVD) indicate network attack vector, high imp...

Omise: SSRF in webhooks leads to AWS private keys disclosure

Vulnerability Summary Omise makes use of Amazon AWS as their application environment. Due to a vulnerability in the way webhooks are implemented, an attacker can make arbitrary HTTP/HTTPS requests from the application server and read their responses. This is known as a server-side request forgery...

CVE-2019-1588 Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode Arbitrary File Read Vulnerability

A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure ACI mode could allow an authenticated, local attacker to read arbitrary files on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms o...

The vulnerability in the web browser Internet Explorer, caused by reading beyond the buffer in memory, allows attackers to access protected information.

The vulnerability of the Internet Explorer browser arises from reading data beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to gain access to protected information by using a specially created web page...

The vulnerability of the archive_read_format_cab_read_header function in the libarchive library, which allows a hacker to cause a service failure.

The vulnerability of the archivereadformatcabreadheader function in the archivereadsupportformatcab.c library of the libarchive library is related to buffer overflow attacks. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using a specially created file...

The vulnerability of the “rdpdr_process” function implementation in the RDP client rdesktop, related to reading beyond the memory boundary, allows a attacker to cause a service failure.

The vulnerability of the “rdpdrprocess” function in the RDP client rdesktop implementation is related to reading data beyond the memory boundary. Exploiting this vulnerability could allow a remote attacker to cause service failures...

Culture Unchained App Has Override Access Vulnerability

Culture Unchained App is a free e-reading application product. A vulnerability exists in Culture Read APP, which can be exploited by attackers to obtain information about other users...

EUVD-2019-18411

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpcdecode can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c...

CVE-2019-9024

Removed by vendor...

CVE-2019-9024

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpcdecode can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c...

httpd: Out of bounds access after failure in reading the HTTP request

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode both log and build level...

libdb: Reads DB_CONFIG from the current working directory

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DBCONFIG in the current directory...

openSUSE Security Update : spice (openSUSE-2019-167)

This update for spice fixes the following issues : Security issue fixed : - CVE-2019-3813: Fixed a out-of-bounds read in the memslotgetvirt function that could lead to denial-of-service or code-execution bsc1122706. Non-security issue fixed : - Include spice-server tweak to compensate for...

Denial Of Service (DoS)

libcurl.so is vulnerable to denial of service DoS. The library does not correctly check input data, allowing an attacker or compromised NTLM server to perform out-of-bounds buffer reading by providing a bad length + offset combination as input...

Out-of-bounds

A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results is a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. This vulnerability affects Firefox 65...

CVE-2018-18504

A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results is a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. This vulnerability affects Firefox 65...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain unauthorized access to read data.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an intruder to gain unauthorized access to read data...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain unauthorized access to read data.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to read data...