3196 matches found
Authorization Bypass
busybox is vulnerable to authorization bypass. The addprobe function in modutils/modprobe.c allows local users to bypass intended restrictions by loading kernel modules via a / character in the module name, as demonstrated by an ifconfig /usbserial up command or a mount -t /sndpcm none / command...
Denial Of Service (DoS)
graphicsmagick is vulnerable to denial of service. The ReadOneJNGImage function in coders/png.c allows remote attackers to crash the application during JNG reading via a zero-length colorimage data structure...
Denial Of Service (DoS)
apng2gif:focal is vulnerable to denial of service. There is improper sanitization of user input causing huge memory allocations, resulting in a crash. This is related to the readchunk function using the pChunk-size value within the PNG file to determine the amount of memory to allocate...
Remote Code Execution (RCE)
firefox:xenial is vulnerable to remote code executionRCE. Memory safety bug shows evidence of memory corruption and with enough effort that some of these could be exploited to run arbitrary code...
SQL Injection in untitled-model
All versions of untitled-model re vulnerable to SQL Injection. Query parameters are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation No fix is currently available. Consider using an alternative package until a fix is made availab...
PT-2020-14817 · Philips · Patient Information Center Ix
Name of the Vulnerable Software and Affected Versions: Patient Information Center iX PICiX versions B.02, C.02, C.03 Description: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is then used as a webpage and served to other...
Sandbox Breakout / Arbitrary Code Execution in safer-eval
All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system. Recommendation The package is not suited to...
Path Traversal in decompress
Versions of decompress prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing../. Recommendation Upgrade to version 4.2.1 or later...
Path Traversal in @wturyn/swagger-injector
All versions of @wturyn/swagger-injector are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured dist folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package...
Path Traversal in swagger-injector
All versions of swagger-injector are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured dist folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a...
Sandbox Breakout / Arbitrary Code Execution in safe-eval
All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code. For example, the payload = const targetKey = Object.keysthis0; Object.definePropertythis,...
Remote Code Execution
pomelo-monitor is vulnerable to remote code execution. An attacker could run arbitrary commands on the server due to lack of validation...
Path Traversal in 626
All versions of 626 are vulnerable to path traversal. This enables a remote attacker to read arbitrary files from the remote server using this module. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time...
GHSA-44G9-W23C-5RW7 Directory Traversal in nhouston
All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as ../ to read files outside of the served directory. Recommendation It is recommended that a different module be used, as we have been unable to reacher the maintainer...
Denial Of Service (DoS)
bl is vulnerable to denial of service. An uninitialized memory access via negative .consume allows an attacker to crash the application and potentially obtain confidential information that is stored in memory...
Cross-Site Request Forgery (CSRF)
nodebb-plugin-blog-comments is vulnerable to cross-site request forgery CSRF. The vulnerability exists due to the lack of authentication token for the POST requests to /comments/reply and /comments/publish in library.js...
ASX To MP3 Converter 3.1.3.7.2010.11.05 Buffer Overflow
Exploit Title: ASX to MP3 converter 3.1.3.7.2010.11.05 - '.wax' Local Buffer Overflow DEP,ASLR Bypass PoC Software Link Download: https://github.com/x00x00x00x00/ASXtoMP3Converter3.1.3.7.2010.11.05/blob/master/ASXtoMP3Converter3.1.3.7.2010.11.05.exe?raw=true Exploit Author: Paras Bhatia Discovery...
PT-2020-13523 · Mosca · Moscajs Aedes
Name of the Vulnerable Software and Affected Versions: MoscaJS Aedes version 0.42.0 Description: An issue was discovered in the handling of exceptions during the writing of an invalid packet to a stream in lib/write.js. Recommendations: For version 0.42.0, update to version 0.42.1 to resolve the...
RSVPMaker < 7.8.2 - Unauthenticated SQL Injection
The plugin does not sanitise user input before using it in a SQL statement in the signedupajax AJAX action. Note: Even though the reported SQL Injection was fixed in v7.8.2, other additional sanitisation was implemented in v7.8.3 to 7.8.6. PoC sqlmap -u "https://localhost/?action=signedupcount=1"...
