1214 matches found
openSUSE Security Update : python3-Django (openSUSE-2018-318)
This update for python3-Django to version 1.18.18 fixes multiple issues. Security issues fixed : - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. bsc1083305 - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters bsc1083304. -...
true-gaming.net XSS vulnerability
Open Bug Bounty ID: OBB-575568 Description| Value ---|--- Affected Website:| true-gaming.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
true-pharm.net XSS vulnerability
Open Bug Bounty ID: OBB-552328 Description| Value ---|--- Affected Website:| true-pharm.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
PT-2018-17644
Name of the Vulnerable Software and Affected Versions Jimtawl versions 2.1.6 through 2.2.5 Description The issue allows for arbitrary file upload in the Jimtawl component for Joomla. This can be achieved through a request to the "view=upload&task=upload&pop=true&tmpl=component" endpoint...
CVE-2017-16365
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the True Type2 Font parsing module. A corrupte...
CVE-2017-16365
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the True Type2 Font parsing module. A corrupte...
Design/Logic Flaw
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the True Type2 Font parsing module. A corrupte...
CVE-2017-16365
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the True Type2 Font parsing module. A corrupte...
CVE-2017-16365
Adobe Acrobat/Reader (2017 and earlier, including 2017.x) is affected by CVE-2017-16365 due to a buffer over-read in the True Type2 Font parsing module caused by a corrupted cmap input, which leads to pointer arithmetic outside the buffer. Impact per the entry: attacker can obtain sensitive infor...
CVE-2017-16365: Out-of-bounds Read
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the True Type2 Font parsing module. A corrupte...
PT-2017-14378
Name of the Vulnerable Software and Affected Versions Adobe Acrobat and Reader versions 2017.012.20098 and earlier Adobe Acrobat and Reader versions 2017.011.30066 and earlier Adobe Acrobat and Reader versions 2015.006.30355 and earlier Adobe Acrobat and Reader versions 11.0.22 and earlier...
True Luck Driver Mobile App Has Logic Design Flaws
True Luck Driver Mobile App is a mobile application that helps truck drivers find work. There is a logical design vulnerability in the True Luck Driver mobile app. An attacker can log into any user account by using the forget password function to capture packet blasting to obtain the verification...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial...
The vulnerability of the Acronis True Image backup and recovery software relates to security configuration errors during updates via HTTP. This allows a malicious actor to execute arbitrary code with administrator privileges.
The vulnerability of the Acronis True Image backup and recovery software relates to security configuration errors during updates via HTTP. In such updates, only those updates that use the MD5 hash provided by the server are verified. Exploiting this vulnerability allows an attacker to execute...
CVE-2017-12794
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you...
PT-2017-12588
Name of the Vulnerable Software and Affected Versions SLiMS versions 8 Akasia through 8.3.1 Description The issue allows remote attackers to perform a complete account takeover by tricking a user into changing their password to an attacker-controlled one. This is possible because there is no CSRF...
CVE-2017-8420
SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image0000000000400000+0x0000000000003e71" issue. This issue can be triggered by a malformed TTF file that is mishandled by font2swf. Attackers could exploit this issue for DoS Access...
Piwigo SQL Injection Vulnerability
Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A SQL injection vulnerability exists in the administrative backend of Piwigo 2.9.1 and previous versions. A remote attack...
PT-2017-11434
Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.10 Description The issue allows remote users to execute arbitrary SQL commands. This can be achieved by exploiting the cat false or cat true parameter in the comments or status page to "cat options.php" API endpoint...