CVE-2018-18912

An issue was discovered in Easy File Sharing EFS Web Server 7.2. A stack-based buffer overflow vulnerability occurs when a malicious POST request has been made to forum.ghp upon creating a new topic in the forums, which allows remote attackers to execute arbitrary code...

UBUNTU-CVE-2018-12546

In Eclipse Mosquitto version 1.0 to 1.5.5 inclusive when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients...

DEBIAN-CVE-2018-12546

In Eclipse Mosquitto version 1.0 to 1.5.5 inclusive when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients...

CVE-2018-12546: Improper Access Control

In Eclipse Mosquitto version 1.0 to 1.5.5 inclusive when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients...

Exploit for Deserialization of Untrusted Data in Drupal

It is an exploit module/toolkit targeting Drupal, specifically a...

CVE-2018-19349

In SeaCMS v6.64, there is SQL injection via the adminmakehtml.php topic parameter because of mishandling in include/mkhtml.func.php...

PT-2018-14933

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.64 Description The issue is related to SQL injection due to mishandling in the include/mkhtml.func.php file. This occurs via the topic parameter in the admin makehtml.php file. Recommendations For SeaCMS version 6.64, consider...

CVE-2018-19349: Improper Neutralization of Special Elements used in an SQL Command

In SeaCMS v6.64, there is SQL injection via the adminmakehtml.php topic parameter because of mishandling in include/mkhtml.func.php...

ALPINE-CVE-2018-12543

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit...

CVE-2018-12543

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit...

CVE-2018-12543: Reachable Assertion

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit...

CVE-2018-1684

IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456...

PT-2018-13768

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ versions 8.0 through 9.1 Description The issue is related to an error with MQTT topic string publishing, which can cause a denial of service attack. Recommendations For IBM WebSphere MQ versions 8.0 through 9.1, update to a...

CVE-2018-1684: Undefined Security Weakness

IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456...

GHSA-26Q7-G57V-MXCP HTML Injection in shout

Affected versions of shout do not escape the /topic command in messages, and are therefore vulnerable to cross-site scripting. Recommendation Update to version 0.50.0 or later...

DEBIAN-CVE-2018-18765

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mgmqttnextsubscribetopic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially...

Cesanta Mongoose buffer overread vulnerability (CNVD-2019-09626)

Mongoose is a cross-platform embedded Web server and networking libraries , its features include TCP, HTTP clients and servers , WebSocket clients and servers , MQTT clients and proxies and so on. A heap buffer over-read vulnerability exists in the MQTT packet parsing feature...

PT-2018-14637

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.13 Description A memory read issue exists in the MQTT packet-parsing functionality, specifically a heap-based buffer over-read in mg mqtt next subscribe topic. This can be triggered by a specially crafted MQTT...

Chaturbate: Stored XSS in chat topic due to insecure emoticon parsing on any message type

Description The funcitonality for adding emoticons into the chat from the serverside perspective is based on a string in the following format: %%%emoticon NAME|EMOTICONURL|WIDTH|HEIGHT|REPORTURL%%% The EMOTICONURL must conform to the following regex: javascript...

PT-2018-11246

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.5 through 1.5.2 Description The issue occurs when a message is published to Mosquitto with a topic starting with $, but not $SYS, causing an assert to be triggered and Mosquitto to exit. Recommendations For Eclipse...