6129 matches found
guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service
A vulnerability was found in Guava where the AtomicDoubleArray and CompoundOrdering classes were found to allocate memory based on size fields sent by the client without validation. A crafted message could cause the server to consume all available memory or crash leading to a denial of service...
PT-2018-12689 · Webpack · Webpack-Dev-Server
Name of the Vulnerable Software and Affected Versions: webpack-dev-server versions prior to 3.1.10 webpack-dev-server versions prior to 3.1.6 Description: An issue in the WebSocket server used for Hot Module Replacement HMR allows attackers to steal a developer's source code because the origin of...
Oracle WebCenter Interaction Portal AjaxControl Component Denial of Service Vulnerability
Oracle WebCenter Interaction is an Oracle suite for creating enterprise portals, collaborative communities, portfolio applications, and social applications.Oracle WebCenter Interaction Portal is an administrative interface.AjaxControl AjaxControl is one of the Ajax control components. A denial of...
Oracle WebCenter Interaction Open Redirect Vulnerability
Oracle WebCenter Interaction is Oracle's suite for creating enterprise portals, collaborative communities, portfolio applications, and social applications.Oracle WebCenter Interaction Portal is one of the management interfaces. An open redirect vulnerability exists in the login functionality in...
Unspecified Vulnerability in IBM Connections
IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A security vulnerabili...
CVE-2018-14635
When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from...
CVE-2018-6320
A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure PCS 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an https Host header received from the browser is trusted without validation...
guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service
A vulnerability was found in Guava where the AtomicDoubleArray and CompoundOrdering classes were found to allocate memory based on size fields sent by the client without validation. A crafted message could cause the server to consume all available memory or crash leading to a denial of service...
CVE-2018-10904
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient...
Samsung Galaxy Apps Elevation of Privilege Vulnerability
Samsung Galaxy Apps is an application store program from Samsung South Korea that is used in Samsung cell phones. An elevation of privilege vulnerability exists in the handling of URLs in Samsung Galaxy Apps, which stems from the program failing to properly validate user-submitted data. A local...
CVE-2018-14903
EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote attackers to cause a printer malfunction or send malicious data to the printer...
Schneider Electric BMX P34 CPU B Open Redirect
Exploit Title: Schneider Electric BMX P34 CPU B - Unvalidated Redirects and Forwards Date: 2018-07-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.schneider-electric.com/ Hardware Link : https://www.schneider-electric.com/en/product/BMXP342020/ Software : Schneider Electric...
NextCloud Talk Cross-Site Scripting Vulnerability
NextCloud Talk is a local video conferencing and online chat solution from NextCloud Germany. The product supports video conferencing, online chat and online voice. A cross-site scripting vulnerability exists in versions prior to NextCloud Talk 3.2.5, which stems from the program failing to...
NextCloud Server Cross-Site Scripting Vulnerability (CNVD-2018-17647)
Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Server is one of the server version. A cross-site scripting vulnerability exists in versions of NextCloud Server prior to 13.0.5, which stems from the...
Delta Electronics CNCSoft and ScreenEditor Stack Buffer Overflow Vulnerability
Delta Electronics CNCSoft and ScreenEditor are products of Delta Electronics, a CNC machine simulation system software and ScreenEditor, a HMI programming software. A stack buffer overflow vulnerability exists in Delta Electronics CNCSoft version 1.00.83 and earlier and ScreenEditor version...
PostgreSQL SQL Injection Vulnerability (CNVD-2020-02199)
PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A SQL injection vulnerability exists in PostgreSQL. The vulnerabili...
Wavemaker Studio 6.6 - Server-Side Request Forgery Vulnerability
Exploit for java platform in category web applications Exploit Title: Wavemaker Studio 6.6 - Server-Side Request Forgery SSRF. Exploit Author: Gionathan "John" Reale Vendor Homepage: http://www.wavemaker.com/ Software Link:...
CVE-2018-7692
Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1...
