5561 matches found
CVE-2017-11714
psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the...
Sensitive Course Structure Information Disclosure
Moodle is vulnerable to sensitive course information disclosure. The disclosure is possible because users with suspended enrollments are not limited from viewing the course structure in the navigation tree...
Remote Code Execution (RCE)
OrientDB Core is vulnerable to remote code execution RCE attacks. Permissions are not enforced on a user executing a statement to the ORole structure containing a where, fetchplan or order by statement. By executing a groovy function where the groovy wrapper doesn't have a sandbox, any system...
CVE-2017-10790
The asn1checkidentifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1node structure. It may lead to a remote denial of service attack...
Microsoft Windows Kernel - 'IOCTL 0x120007 NsiGetParameter' nsiproxy/netio Pool Memory Disclosure
/ We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys \.\Nsi device discloses portions of uninitialized pool memory to user-mode clients, likely due to output structure alignment holes. On our test Windows 7 32-bit workstation, an example layout of the output buffer is as...
CVE-2017-7681
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end...
CVE-2017-7681
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end...
Sql injection
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end...
PYSEC-2017-118
There is a heap-based buffer over-read in the Image::printIFDStructure function in image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of service attack...
Exiv2 'Image::printIFDStructure' heap buffer overflow vulnerability
Exiv2 is a cross-platform C++ library and command line utility for managing image metadata. The Image::printIFDStructure function in Exiv2's image.cpp suffers from a heap buffer overflow that allows an attacker to conduct a remote denial-of-service attack with specially designed inputs...
Exiv2 'Image::printIFDStructure' heap buffer overflow vulnerability
Exiv2 is a set of C++ libraries and command line applications for managing image metadata by software developer Andreas Huggel, which provides fast and easy reading and writing of image metadata in a variety of EXIF, IPTC and XMP formats. A heap buffer overflow vulnerability exists in the...
CVE-2017-7681
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end...
Internet Bug Bounty: PHP WDDX Deserialization Heap OOB Read in timelib_meridian()
Description: While deserializing an invalid dateTime value, wddxdeserialize would result in a heap out-of-bounds read in timelibmeridian. As wddxdeserialize is exposed to network data, and sometimes echo the results back to client, this issue could potentially allow remote peeking of the process...
CVE-2017-11102
The ReadOneJNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service application crash during JNG reading via a zero-length colorimage data structure...
UBUNTU-CVE-2017-10790
The asn1checkidentifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1node structure. It may lead to a remote denial of service attack...
Microsoft Windows - win32k!NtGdiExtGetObjectW Kernel Stack Memory Disclosure Exploit
Exploit for windows platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1178 We have discovered that it is possible to disclose portions of uninitialized kernel stack memory in Windows 7-10 through the win32k!NtGdiExtGetObjectW system call accessible...
exiv2 'Image::printIFDStructure' Denial of Service Vulnerability
Exiv2 is a suite of C++ libraries and command line applications for managing image metadata, providing fast and easy reading and writing of image metadata in a wide range of EXIF, IPTC and XMP formats. The Image::printIFDStructure security vulnerability in Exiv2 version 0.26. A remote attacker ca...
Windows Kernel stack memory disclosure in nt!NtQueryInformationWorkerFactory(CVE-2017-0300)
We have discovered that the nt!NtQueryInformationWorkerFactory system call called with the WorkerFactoryBasicInformation 7 information class discloses portions of uninitialized kernel stack memory to user-mode clients, on Windows 7 to Windows 10. The specific layout of the output structure...
Windows Kernel pool memory disclosure in nt!NtNotifyChangeDirectoryFile(CVE-2017-0299)
We have discovered that the nt!NtNotifyChangeDirectoryFile system call discloses portions of uninitialized pool memory to user-mode clients, due to output structure alignment holes. On our test Windows 10 32-bit workstation, an example layout of the output buffer is as follows: --- cut ---...