10714 matches found
CVE-2013-7469
Seafile through 6.2.11 always uses the same Initialization Vector IV with Cipher Block Chaining CBC Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks...
Linux kernel DoS
The vulnerability of the Linux operating system’s kernel is caused by a buffer overflow. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2019-7018
Name of the Vulnerable Software and Affected Versions Seafile versions prior to 6.2.12 Description The issue makes it easier to conduct chosen-plaintext attacks or dictionary attacks due to the use of the same Initialization Vector IV with Cipher Block Chaining CBC Mode to encrypt private data...
DEBIAN-CVE-2019-5757
An incorrect object type assumption in SVG in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page...
Ryuk, Exploring the Human Connection
ARCHIVED STORY Ryuk, Exploring the Human Connection By John Fokker · Febraury 19, 2019 In collaboration with Bill Siegel and Alex Holdtman from Coveware At the beginning of 2019, McAfee ATR published an article describing how the hasty attribution of Ryuk ransomware to North Korea was missing the...
Code injection
The seadroid aka Seafile Android Client application through 2.2.13 for Android always uses the same Initialization Vector IV with Cipher Block Chaining CBC Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks...
CVE-2019-8919: Use of Insufficiently Random Values
The seadroid aka Seafile Android Client application through 2.2.13 for Android always uses the same Initialization Vector IV with Cipher Block Chaining CBC Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks...
CVE-2019-8341
An issue was discovered in Jinja2 2.10. The fromstring function is prone to Server Side Template Injection SSTI where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with INJECTION COMMANDS in a URI. NOTE: The maintainer and...
Multiple Lexmark Product Input Validation Vulnerabilities
Lexmark is an American developer and manufacturer of printers. An input validation vulnerability exists in multiple Lexmark products, which could be exploited by an attacker to perform a delete operation...
CVE-2019-7740
An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code core.js writeDynaList could lead to an XSS attack vector...
Microsoft Edge Memory Corruption Vulnerability
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the...
chromium-browser: Type Confusion in SVG
An incorrect object type assumption in SVG in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page...
Adobe Flash Player ActionScript Vector Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Flash Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
[SECURITY] Fedora 28 Update: libwmf-0.2.12-1.fc28
A library for reading and converting Windows MetaFile vector graphics WMF...
[SECURITY] Fedora 29 Update: libwmf-0.2.12-1.fc29
A library for reading and converting Windows MetaFile vector graphics WMF...
CVE-2018-3991
An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500. A specially crafted TCP packet can cause a heap overflow, potentially leading to remote code execution. An attacker can send a malformed TCP packet to trigg...
CVE-2017-1177
CVE-2017-1177 affects IBM BigFix Compliance 1.7–1.9.91, disclosing sensitive information to unauthorized users. Reported as a medium-severity issue (CVSS v2 base 5.0; CVSS v3 base 5.3) with network vector and no user interaction required. The material notes potential to mount further attacks usin...
OpenMRS Platform 2.24.0 - Insecure Object Deserialization
OpenMRS Platform 2.24.0 - Insecure Object Deserialization Insecure Object Deserialization on the OpenMRS Platform Vulnerability Details CVE ID: CVE-2018-19276 Access Vector: Remote Security Risk: Critical Vulnerability: CWE-502 CVSS Base Score: 10.0 CVSS vector:...
UBUNTU-CVE-2019-7351
Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value...
Security Bulletin: Vulnerabilities in OpenSSL affect System x Integrated Management Module (IMM) (CVE-2015-0204, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275)
Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by System x Integrated Management Module IMM. IMM has addressed the applicable CVEs...