GLSA-201701-38 : Pidgin: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201701-38 Pidgin: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Pidgin. Please review the CVE identifiers referenced below for details. Impact : A remote attacker might send specially crafted data using...

Remote Execution Through Object Deserialization

Apache Groovy is vulnerable to remote execution.The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.7 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object. Note this is similar to CVE-2015-3253 but this...

MetalGenix GeniXCMS SQL Injection Vulnerability (CNVD-2017-00559)

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A SQL injection vulnerability exists in the inc/mod/newsletter/options.php file in MetalGenix GeniXCMS...

MetalGenix GeniXCMS SQL Injection Vulnerability (CNVD-2017-00557)

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A SQL injection vulnerability exists in the inc/lib/Control/Ajax/tags-ajax.control.php file in MetalGenix...

FreeBSD : groovy -- remote execution of untrusted code/DoS vulnerability (4af92a40-db33-11e6-ae1b-002590263bf5)

The Apache Groovy project reports : When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when...

CVE-2017-5347

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

PHP Use of uninitialized memory in unserialize() （CVE-2017-5340）

Description: ------------ There was found a bug showing that PHP uses uninitialized memory during calls to unserialize. As the following report shows, the payload supplied to unserialize may control this uninitialized memory region and thus may be used to trick PHP into operating on faked objects...

CVE-2016-7480

Removed by vendor...

Vim, gVim: Remote execution of arbitrary code

Background Vim is an efficient, highly configurable improved version of the classic ‘vi’ text editor. gVim is the GUI version of Vim. Description Vim and gVim do not properly validate values for the ‘filetype’, ‘syntax’, and ‘keymap’ options. Impact A remote attacker could entice a user to open a...

UBUNTU-CVE-2017-5336

Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate...

IBM WebSphere MQ Remote Code Execution Vulnerability

IBM MQ and WebSphere MQ are both products of the U.S. company IBM. The former is a messaging middleware used to simplify and accelerate the integration of various applications and business data across multiple platforms, and the latter is a messaging middleware product. A remote code execution...

kernel: Use-after-free in the recvmmsg exit path

A use-after-free vulnerability was found in the kernel's socket recvmmsg subsystem. This may allow remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within sysrecvmmsg function...

Adobe Reader DC XSLT function-available Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within XSLT's...

ALPINE-CVE-2016-8704

An integer overflow in the processbinappendprepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution...

CVE-2016-10009

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS11 modules by leveraging control over a forwarded agent-socket...

PhpMailer and SwiftMailer, the ZendMail successive exposure of the RCE high-risk vulnerabilities, affecting millions of Web servers-vulnerability warning-the black bar safety net

! Researchers recently found a present in 3 common open source PHP Library for high-riskCriticalvulnerabilities, hackers can exploit this vulnerability to remotely execute arbitrary commands, there is a vulnerability in the PHP library includes SwiftMailer And PhpMailer and ZendMail it. A few day...

CVE-2016-10009

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS11 modules by leveraging control over a forwarded agent-socket...

Audacity 2.1.2 DLL Hijacking Vulnerability

Tempest Security Intelligence Advisory ADV-7/2016 - Audacity version 2.1.2 is vulnerable to dll hijacking as it tries to load avformat-55.dll without supplying the absolute path, thus relying upon the presence of such dll on the system directory. This behavior results in an exploitable dll...

GLSA-201701-15 : Mozilla Firefox, Thunderbird: Multiple vulnerabilities (SWEET32)

The remote host is affected by the vulnerability described in GLSA-201701-15 Mozilla Firefox, Thunderbird: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Mozilla Firefox and Thunderbird. Please review the CVE identifiers referenced below for details. Impact : A remote...

GLSA-201612-55 : libjpeg-turbo: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201612-55 libjpeg-turbo: User-assisted execution of arbitrary code The accelerated Huffman decoder was previously invoked if there were 128 bytes in the input buffer. However, it is possible to construct a JPEG image with Huffman...