Google Chrome < 64.0.3282.119 Multiple Vulnerabilities

Binary data 700352.pasl...

nodejs: Out of bounds (OOB) write via UCS-2 encoding

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le', Bufferwrite can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last...

CVE-2018-15120

libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via crafted text with invalid Unicode sequences...

Mozilla Firefox ESR < 52.4 Multiple Vulnerabilities

Binary data 700331.prm...

Mozilla Firefox ESR < 52.8 Multiple Vulnerabilities

Binary data 700337.prm...

PT-2018-12880

Name of the Vulnerable Software and Affected Versions Pango versions 1.40.8 through 1.42.3 Description The issue allows remote attackers to cause a denial of service, potentially leading to an application crash, or possibly have other unspecified impacts. This is achieved through crafted text...

pcre: Invalid Unicode property lookup (8.41/7, 10.24/2)

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service segmentation violation for read access, and application crash by triggering an invalid Unicode property lookup...

CVE-2018-2441

CVE-2018-2441 affects SAP Change and Transport System (ABAP) and SAP KERNEL variants including 32/64 NUC/Unicode across multiple 7.x releases (7.21, 7.21EXT, 7.22, 7.22EXT, 7.45, 7.49, 7.53, 7.73). Root cause details are not provided in the documents. The vulnerability would allow an attacker to ...

CVE-2018-2441: Undefined Security Weakness

Under certain conditions the SAP Change and Transport System ABAP, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49, 7.53 and 7.73, allows an attacker to transport information which would otherwis...

EulerOS 2.0 SP3 : procps-ng (EulerOS-SA-2018-1230)

According to the versions of the procps-ng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any securi...

MathJax Cross-Site Scripting Vulnerability

MathJax is an open source JavaScript display engine . A cross-site scripting vulnerability exists in the \unicode macro in MathJax versions prior to 2.7.4. A remote attacker can exploit this vulnerability to execute untrusted Javascript code in a web browser...

GHSA-3C48-6PCV-88RM Macro in MathJax running untrusted Javascript within a web browser

MathJax version prior to version 2.7.4 contains a Cross Site Scripting XSS vulnerability in the \unicode macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processe...

AZL-41294 CVE-2018-1999024 affecting package numpy for versions less than 1.26.3-4

MathJax version prior to version 2.7.4 contains a Cross Site Scripting XSS vulnerability in the \unicode macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processe...

DEBIAN-CVE-2018-1999024

MathJax version prior to version 2.7.4 contains a Cross Site Scripting XSS vulnerability in the \unicode macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processe...

CVE-2018-1999024

MathJax version prior to version 2.7.4 contains a Cross Site Scripting XSS vulnerability in the \unicode macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processe...

UBUNTU-CVE-2018-1999024

MathJax version prior to version 2.7.4 contains a Cross Site Scripting XSS vulnerability in the \unicode macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processe...

PT-2018-15203 · Mathjax +1 · Mathjax +1

Name of the Vulnerable Software and Affected Versions: MathJax versions prior to 2.7.4 Description: The issue concerns a Cross Site Scripting XSS vulnerability in the unicode macro. This vulnerability can result in potentially untrusted JavaScript running within a web browser. The attack appears ...

CVE-2018-1999024: Improper Neutralization of Input During Web Page Generation

MathJax version prior to version 2.7.4 contains a Cross Site Scripting XSS vulnerability in the \unicode macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processe...

Vanilla: Bypassing the Trusted Link Alert System

Summary: I have discovered a means of bypassing the system that will alert users of an untrusted link utilizing the Right to Left Overrride unicode character. The alert looks like this: https://i.imgur.com/9rp1K7b.mp4 Description: For this demonstration, I have added "facebook.com" to the trusted...

CVE-2017-7481

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2...