Dokuwiki 2018-04-22b - Username Enumeration

Exploit Title: Dokuwiki 2018-04-22b - Username Enumeration Date: 2019-12-01 Exploit Author: Talha ŞEN Vendor Homepage: https://www.dokuwiki.org/dokuwiki Software Link: https://download.dokuwiki.org/ Version: 2018-04-22b "Greebo" Tested on: Alpine Linux 3.5 docker image PHP 5.6.30 Apache/2.4.25 Un...

Default configuration

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure for example by setting RLIMIT, causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots...

CVE-2019-14865

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure for example by setting RLIMIT, causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots...

Xiaomi Mi Box Memory Corruption Vulnerability

Xiaomi Mi Box is a Xiaomi set-top box application. Xiaomi Mi Box suffers from a memory corruption vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the currently logged in user, potentially resulting in a denial of service condition...

UBUNTU-CVE-2019-18276

An issue was discovered in disableprivmode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems th...

CVE-2019-14865

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure for example by setting RLIMIT, causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots. Mitigation Remove the...

DEBIAN-CVE-2015-5694

Designate does not enforce the DNS protocol limit concerning record set sizes...

CVE-2015-5694

Designate does not enforce the DNS protocol limit concerning record set sizes...

CVE-2015-5694

Designate does not enforce the DNS protocol limit concerning record set sizes...

Code injection

Designate does not enforce the DNS protocol limit concerning record set sizes...

PYSEC-2019-243

Designate does not enforce the DNS protocol limit concerning record set sizes...

PYSEC-2019-243

Designate does not enforce the DNS protocol limit concerning record set sizes...

UBUNTU-CVE-2015-5694

Designate does not enforce the DNS protocol limit concerning record set sizes...

CVE-2015-5694

Designate does not enforce the DNS protocol limit concerning record set sizes...

CVE-2015-5694

Technical details for CVE-2015-5694 are not publicly available in the provided documents. Monitor for updates.

DEBIAN-CVE-2019-14818

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhostuser socket, can send specially crafted VRINGSETNUM messages, resulting in a memory leak including file...

PSF-2019-14 Regular Expression Denial of Service in http.cookiejar

The regex http.cookiejar.LOOSEHTTPDATERE is vulnerable to regular expression denial of service "REDoS". LOOSEHTTPDATERE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a HTTP server. Processing a response from a malicious HTTP server can lead to extreme...

CVE-2019-2205

In ProxyResolverV8::SetPacScript of proxyresolverv8.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0...

Magento Cross-Site Scripting via Attribute Set Name

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products...

GHSA-XV69-F7X5-R4QW Magento Cross-Site Scripting via Attribute Set Name

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products...