AZL-6424 CVE-2019-6293 affecting package flex for versions less than 2.6.4-7

An issue was discovered in the function markbeginningasnormal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the markbeginningasnormal function making recursive calls to itself in certain scenarios involving lots of '' characters. Remote attackers could leverage this...

UBUNTU-CVE-2018-25010

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter...

PT-2023-17149 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac/gpac versions prior to 2.4.0 Description: A Heap-based Buffer Overflow issue has been identified. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incident...

GHSA-X3G3-334F-Q6H4 Pandao editor.md vulnerable to DOM XSS

pandao Editor.md 1.5.0 has DOM XSS via input starting with a substring, which is mishandled during construction of an A element...

CVE-2018-3289

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

PYSEC-2018-47

Cross-site scripting XSS vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-7077

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6...

CVE-2018-7680

Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values...

CVE-2018-5126

Memory safety bugs were reported in Firefox 58. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox 59...

CVE-2018-5091

A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR 52.6 and Firefox 58...

CVE-2018-5100

A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" function are freed while still in use by scripts. This results in a potentially exploitable crash. This vulnerability affects Firefox 58...

Joomla! Core Arbitrary File Upload Vulnerability (CNVD-2018-15189)

Joomla! is an open source content management system CMS. The system provides RSS feeds , site search and other features . Joomla! Core is a Joomla! core. Core 3.8.8 before the version of the arbitrary file upload vulnerability exists. A remote attacker can exploit this vulnerability to upload...

UBUNTU-CVE-2018-5181

If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with...

Exim < 4.90.1 - 'base64d' Remote Code Execution

!/usr/bin/python import time import socket import struct s = None f = None def logo: print print " CVE-2018-6789 Poc Exploit" print "@straightblast ; [email protected]" print def connecthost, port: global s global f s = socket.createconnectionhost,port f = s.makefile'rw', bufsize=0 def p...

CVE-2016-9645

The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229...

CVE-2018-7231

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'system.opkg.remove'...

CVE-2017-9267

In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operations...

PT-2018-1443

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 28.0.0.161 Description The issue is related to a use-after-free vulnerability, which occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. This can allo...

KLA11186 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, spoof user interface and execute arbitrary code. Below is a complete list of vulnerabilities: 1. Multiple use-after-free vulnerabilities can be...

Plexus-utils Command Injection Vulnerability

Plexus-utils is an open source collection of multiple utility classes. A command injection vulnerability exists in versions of Plexus-utils prior to 3.0.16. No details of the vulnerability are provided at this time...