Adobe Flash PSDK Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSDK...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

3: Pulling of any image is possible with it manifest

An input validation flaw was found in the way OpenShift handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image...

Design/Logic Flaw

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened...

Barco ClickShare Arbitrary File Disclosure Vulnerability

ClickShare is Barco's wireless presentation collaboration system that allows all participants to share content on a centralized conference room screen. An arbitrary file disclosure vulnerability exists in Barco ClickShare because it does not adequately validate user-supplied input. An attacker...

Red Hat OpenShift Enterprise Security Bypass Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that builds, tests, deploys, and runs applications.OpenShift Enterprise is an open source version of the private cloud. A security vulnerability exists in Red Hat OpenShift Enterprise that stems from the...

OIC Exponent CMS Information Disclosure Vulnerability

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. An information disclosure...

Amazon Linux: Security Advisory (ALAS-2016-731)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-1000033

Shotwell version 0.22.0 and possibly other versions is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks...

UBUNTU-CVE-2016-1000033

Shotwell version 0.22.0 and possibly other versions is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks...

Command Injection Vulnerability in AVTECH DVRs

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. A command injection vulnerability exists in AVTECH DVR. Because the interface query function does not filter and validate th...

Git-hub Remote Code Execution Vulnerability

GitHub is a hosting platform for open source and private software projects. A remote code execution vulnerability exists in GitHub repository URLs are not sufficiently validated, which can be exploited by an attacker to execute arbitrary code...

Acrobat Reader DC XFA CPDField Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Acrobat Reader DC XFA template Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

cfme: Incorrect sanitization in regular expression engine

An input validation flaw was found in the way CloudForms regular expressions were passed to the expression engine via both the JSON API and the web based UI. A user with the ability to view collections and filter them could use this flaw to execute arbitrary shell commands on the host with the...

CVE-2016-5963

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

The vulnerability of the Mac OS X operating system allows a hacker to execute arbitrary code in a privileged context.

The vulnerability of the Mac OS X operating system’s login window exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context using a specially created application...

Design/Logic Flaw

SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, does not properly validate the return values of ChopMonoAtY calls, which allows remote attackers to cause a denial of service uninitialized memory access and application crash or...

RaiseDreams Crowdfunding System 2.2.4 suffers from a login validation design vulnerability

RaiseDreams is an enterprise-level crowdfunding website platform. A login validation design vulnerability exists in the RaiseDreams crowdfunding system 2.2.4, which arises because the user login password is not verified, allowing an attacker to exploit the vulnerability to log in to the system an...

The vulnerability of the Android operating system, which allows a hacker to trigger a service failure

The vulnerability of the Android operating system’s telephony component exists due to insufficient checking of input data. Exploiting this vulnerability allows a malicious actor to cause a service failure by changing the value of NITZ to 19.01.2016 or later, thereby misconfiguring the system time...