CVE-2018-5178

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR 52.8, Thunderbird 52.8, and...

JerryScript heap buffer overread vulnerability (CNVD-2018-15379)

JerryScript is a lightweight JavaScript engine designed to run on very constrained devices such as microcontrollers. A heap buffer over-read vulnerability exists in the litreadcodeunitfromutf8 function in JerryScript 1.0 related to reparsecharclass in parser/regexp/re-parser.c. An attacker can...

FreeBSD : perl -- multiple vulnerabilities (41c96ffd-29a6-4dcc-9a88-65f5038fa6eb)

perldelta : CVE-2018-6797: heap-buffer-overflow WRITE of size 1 in Sregatom regcomp.c A crafted regular expression could cause a heap buffer write overflow, with control over the bytes written. perl 132227 CVE-2018-6798: Heap-buffer-overflow in Perlbytedumpstring utf8.c Matching a crafted locale...

perl -- multiple vulnerabilities

perldelta: CVE-2018-6797: heap-buffer-overflow WRITE of size 1 in Sregatom regcomp.c A crafted regular expression could cause a heap buffer write overflow, with control over the bytes written. perl 132227 CVE-2018-6798: Heap-buffer-overflow in Perlbytedumpstring utf8.c Matching a crafted locale...

CVE-2018-6521

The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions...

UBUNTU-CVE-2018-6521

The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions...

CVE-2018-6521

The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions...

CVE-2018-6521

CVE-2018-6521 affects SimpleSAMLphp SQLaUTH: before 1.15.2, the MySQL utf8 charset truncates queries at four-byte characters, potentially allowing remote attackers to bypass access restrictions. Affected: SimpleSAMLphp SQLaUTH module. Root cause: reliance on utf8 charset causing truncation. Impac...

CVE-2018-6521

The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions...

CVE-2018-6521

The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions...

SimpleSAML php Access Restriction Bypass Vulnerability

SimpleSAMLphp is a program written in native PHP to handle authentication. An access restriction bypass vulnerability exists in SimpleSAMLphp before 1.15.2. The vulnerability arises because the sqlauth module in SimpleSAMLphp relies on the MySQL utf8 character set, which truncates queries when it...

Fedora 27 : systemd (2017-6263c938c7)

Use infinite timeouts for passwords during boot when JobTimeoutSec=0 - Some tty utf8-mode fixes - Only send one auxillary fd set over dbus - Various network-manager crash and spurious assert fixes - Do not remount network filesystems ro during shutdown and unmount DM devices better - Fix...

International Components for Unicode (ICU) for C/C++ Stack Buffer Overflow Vulnerability

International Components for Unicode ICU is the U.S. IBM and other companies to develop a C / C + + and Java programming languages provide a complete set of Unicode data manipulation function library, but also an open-source project to support the internationalization of software. A denial of...

DuoDuoRebate V8.3_UTF8 official version admin_mod_goods_list.act.php has SQL injection vulnerability

DuoDuo rebate for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuoRebate V8.3UTF8 official version adminmodgoodslist.act.php SQL injection vulnerability exists, the vulnerability is due to the system fails to effectively filter the content ...

MongoDB libbson denial of service vulnerability

MongoDB libbson is a U.S. MongoDB company provides a utility library to build and parse BSON documents and other functions . A security vulnerability exists in the 'bson-itercodewscope' function of the bson-iter.c file in MongoDB libbson version 1.7.0. A remote attacker can exploit this...

DEBIAN-CVE-2017-14227

In MongoDB libbson 1.7.0, the bsonitercodewscope function in bson-iter.c miscalculates a bsonutf8validate length argument, which allows remote attackers to cause a denial of service heap-based buffer over-read in the bsonutf8validate function in bson-utf8.c, as demonstrated by bson-to-json.c...

libbson -- Denial of Service

mongodb developers report: In MongoDB libbson 1.7.0, the bsonitercodewscope function in bson-iter.c miscalculates a bsonutf8validate length argument, which allows remote attackers to cause a denial of service heap-based buffer over-read in the bsonutf8validate function in bson-utf8.c, as...

Invision Power Board 4.1.19.2 XSS / CSRF / File Upload / Information Disclosure

Description: Invision Power Board version 4.1.19.2 current version as of this release and below, is vulnerable to pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18 and stored XSS in the Announcements. The vulnerability in the IPS UTF8 Converter can easily be used to make a malicious...

Invision Power Board 4.1.19.2 XSS / CSRF / File Upload / Disclosure

| \ | \ | | | | | | / \ | | | |/ / | |/ / | | | | | | | | | / / | | | / | / | | | | | | | | | | | | | | | |\ \ \ / / // / | | | /\ | | | | | / / / / / | | | \ | | / | | | / \ | | | | | \ | | | | \ \ / / | | | | | \ --. | | | / / | | | | | |/ / | | | | \ V / | | | . | --. \ | | | | | |...

Cross site scripting

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision...