PT-2018-16156 · Node · Resolve-Path

Name of the Vulnerable Software and Affected Versions: resolve-path versions prior to 1.4.0 Description: The issue arises from a lack of validation of paths containing certain special characters in the resolve-path node module, allowing a malicious user to read the content of any file with a know...

Cross site scripting

init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting XSS because logging is mishandled. This is fixed in 1.4.0...

CVE-2018-8003

Apache Ambari, versions 1.4.0 to 2.6.1, is susceptible to a directory traversal attack allowing an unauthenticated user to craft an HTTP request which provides read-only access to any file on the filesystem of the host the Ambari Server runs on that is accessible by the user the Ambari Server is...

Use after free in File#initilialize_copy

In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::Fileinitilializecopy. An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code...

RubyGems 'delayed_job_web' Cross-Site Scripting Vulnerability

RubyGems delayedjobweb is a web management tool for delayedjob task delay. A cross-site scripting vulnerability exists in RubyGems 'delayedjobweb' version 1.4.0, which stems from the program failing to adequately filter user-submitted input. A remote attacker can exploit this vulnerability to...

GHSA-2W67-526P-GM73 redis-store deserializes untrusted data

Redis-store prior to 1.4.0 allows unsafe objects to be loaded from redis...

samtools htslib library CRAM rANS codec buffer overflow vulnerability

The samtools htslib library is a C language library for high throughput sequencing data formats. cram rANS codec is one of the codecs. A buffer overflow vulnerability exists in the CRAM rANS codec in samtools htslib library version 1.4.0 and earlier. An attacker can exploit this vulnerability to...

Pivotal Software Cloud Foundry cf-release and Staticfile buildpack authentication vulnerabilities

Pivotal Software Cloud Foundry cf-release and Staticfile buildpack are both products of Pivotal Software, Inc.Cloud Foundry cf-release is an open source Platform-as-a-Service PaaS cloud computing platform that provides Cloud Foundry cf-release is an open source Platform-as-a-Service PaaS cloud...

Xiph.Org vorbis-tools 'wav_open' function denial of service vulnerability

Xiph.Org vorbis-tools is a set of Ogg an audio compression format vorbis tools. A security vulnerability exists in the 'wavopen' function of the oggenc/audio.c file in Xiph.Org vorbis-tools version 1.4.0. A remote attacker can exploit this vulnerability to cause a denial of service memory...

iSelect 1.4 Local Buffer Overflow

Exploit developed using Exploit Pack v7.01 Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: iSelect Affected value: -k, --key=KEY Version: 1.4.0-2+b1 Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org Program description:...

Exploit for CVE-2015-1427

Elasticsearch 1.4.0 1.4.2 Remote Code Execution Elastics...

CVE-2016-6276

Citrix Linux Virtual Delivery Agent aka VDA, formerly Linux Virtual Desktop before 1.4.0 allows local users to gain root privileges via unspecified vectors...

Content Injection

Overview Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly deny link protocols, and consequently allowed javascript: to be used. Proof of Concept Markdown Source: link Rendered HTML...

AZL-7403 CVE-2015-6749 affecting package vorbis-tools for versions less than 1.4.0-35

Buffer overflow in the aiffopen function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service crash via a crafted AIFF file...

Joomla! Helpdesk Pro plugin cross-site scripting vulnerability

Joomla! is a well-known content management system in foreign countries. Joomla! is a software system developed using the PHP language coupled with a MySQL database, which can be implemented on a variety of different platforms such as Linux, Windows, MacOSX and so on. Helpdesk Pro plugin version...

The vulnerability of the Gentoo Linux operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the imlib2 package up to version 1.4.0-r1 of the Gentoo Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...

Vorbis Tools Denial of Service Vulnerability (CNVD-2015-00651)

vorbis-tools is a set of Ogg an audio compression format vorbis tools. A security vulnerability exists in the oggenc/oggenc.c file in vorbis-tools version 1.4.0. A local attacker can exploit this vulnerability to cause a denial of service out-of-bounds read with a specially crafted raw file...

Elasticsearch vulnerability CVE-2014-6439

Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user’s browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss or compromise. We have been...

BirdBlog 1.4 /admin/admincore.php msg Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21184/info BirdBlog is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

PT-2014-3527 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions 1.4.0 through 1.4.x Description: The issue allows remote attackers to obtain sensitive information via the hostname parameter. This is related to spoofing, where access to provisioning template previews is not properly...