Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

Design/Logic Flaw

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-17534

uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521...

CVE-2017-17534

uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521...

CVE-2017-17532

examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

Apple Mac OS X Security Updates (HT208331)-02

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Foxit Reader Circle Annotations author Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the author attribut...

Foxit Reader Annotations arrowEnd Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the arrowEnd...

CVE-2017-1000122

The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service release assertion of the UI process. This vulnerability does not affect Apple products...

F5 Networks BIG-IP : Vim vulnerability (K22183127)

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened. CVE-2016-1248 C Tenable Network Security, Inc. The descriptive text and package...

Email address is not validated when updating user profile

On the view profile page /secure/ViewProfile.jspa it's possible to update your user profile /secure/EditProfile!default.jspa?username=admin to an invalid email address. See attached screenshots. !Screen Shot 2017-09-28 at 2.49.48 PM.png|thumbnail! !Screen Shot 2017-09-28 at 2.49.58...

CVE-2017-14849

Node.js 8.5.0 before 8.6.0 is vulnerable to directory traversal/file disclosure due to a changed handling of ".." that conflicts with pathname validation in some community modules. The issue allows remote attackers to access unintended files. A fix is available in Node.js 8.6.0 or later. If upgra...

CVE-2017-14646

The AP4AvccAtom and AP4HvccAtom classes in Bento4 version 1.5.0-617 do not properly validate data sizes, leading to a heap-based buffer over-read and application crash in AP4DataBuffer::SetData in Core/Ap4DataBuffer.cpp...

CVE-2017-8713

CVE-2017-8713 refers to a Hyper-V information disclosure vulnerability in Windows Hyper-V component. Affected products include Windows 8.1, Windows Server 2012 (Gold/R2), Windows 10 (various builds: Gold, 1511, 1607, 1703), and Windows Server 2016. The issue arises when Hyper-V fails to properly ...

Microsoft Windows Hyper-V Denial of Service Vulnerability (CNVD-2017-32916)

Microsoft Windows and Windows Server are both products of Microsoft Corporation.Windows is a family of operating systems.Windows Server is a family of server operating systems.Hyper-V is one of the virtualization products. A denial of service vulnerability exists in the Hyper-V component of...

CVE-2017-14164

A size-validation issue was discovered in opjj2kwritesot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service heap-based buffer overflow affecting opjwritebytesLE in lib/openjp2/cio.c or possibly remote code execution...

CVE-2017-14164

OpenJPEG 2.2.0 contains a size-validation flaw in opj_j2k_write_sot (lib/openjp2/j2k.c) that can cause an out-of-bounds write, leading to remote denial of service or possibly remote code execution. This CVE-2017-14164 is one of several vulnerabilities reported in OpenJPEG; upstream advisories not...

CVE-2017-14164

A size-validation issue was discovered in opjj2kwritesot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service heap-based buffer overflow affecting opjwritebytesLE in lib/openjp2/cio.c or possibly remote code execution...

Microsoft Info - Filter Bypass & Persistent Vulnerability

Document Title: =============== Microsoft Info - Filter Bypass & Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2023 MSRC ID: TRK:0901002416 Release Date: ============= 2017-09-05 Vulnerability Laboratory ID VL-ID:...

Format string

An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.220170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code...