Cross-Site Scripting in @nuxt/devalue

Versions of @nuxt/devalue prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys. Recommendation Upgrade to version 1.2.3 or later...

PT-2019-18485 · Linear · Linear Emerge E3-Series

Name of the Vulnerable Software and Affected Versions: Linear eMerge E3-Series devices affected versions not specified Description: The issue allows for cross-site scripting XSS attacks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

Wrong And Predictable Encryption

github.com/golang/crypto is vulnerable to predictable encryption. In the keystream generation of more than 256 GiB in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa, it can first generate incorrect output and finally cycling back to the previously...

PT-2019-18510 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The issue is related to the session-ID being of an insufficient length, making it vulnerable to brute force exploitation. This could allow a remote attacker to obtain a valid sessio...

PT-2019-18503 · Optergy · Optergy Proton/Enterprise

Name of the Vulnerable Software and Affected Versions: Optergy Proton/Enterprise devices affected versions not specified Description: The issue allows Cross-Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application...

PT-2019-17050 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue allows an unauthorized user to obtain sensitive information about system users by using specially crafted HTTP requests. Recommendations: For versions 5.0.0.0 through...

Tuneclone 2.20 - Local SEH Buffer Overflow

Exploit Title: TuneClone Local Seh Exploit Date: 19.06.2019 Vendor Homepage: http://www.tuneclone.com/ Software Link: http://www.tuneclone.com/tuneclonesetup.exe Exploit Author: Achilles Tested Version: 2.20 Tested on: Windows XP SP3 EN 1.- Run python code : TuneClone.py 2.- Open EVIL.txt and cop...

Command Injection

Overview Versions of wiki-plugin-datalog prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system. Recommendation Upgrade to version 0.1.6 or later...

Denial Of Service (DoS)

firefox/thunderbird is vulnerable to denial of service. A use-after-free vulnerability can occur when working with XMLHttpRequest XHR in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash...

eLabFTW 1.8.5 - Arbitrary File Upload / Remote Code Execution

Exploit Title : eLabFTW 1.8.5 'EntityController' Arbitrary File Upload / RCE Date : 5/18/19 Exploit Author : liquidsky JMcPeters Vulnerable Software : eLabFTW 1.8.5 Vendor Homepage : https://www.elabftw.net/ Version : 1.8.5 Software Link : https://github.com/elabftw/elabftw Tested On : Linux / PH...

eLabFTW 1.8.5 - Arbitrary File Upload Remote Code Execution

eLabFTW 1.8.5 - Arbitrary File Upload Remote Code Execution !/usr/bin/env python Exploit Title : eLabFTW 1.8.5 'EntityController' Arbitrary File Upload / RCE Date : 5/18/19 Exploit Author : liquidsky JMcPeters Vulnerable Software : eLabFTW 1.8.5 Vendor Homepage : https://www.elabftw.net/ Version ...

Privilege Escalation

Firefox and Firefox ESR are vulnerable to privilege escalation attacks. This is because the authentication is insufficient for channels created after the IPC process is started which allow for a sandbox escape through IPC channels due to lack of message validation in the listener process, result ...

Cross Site Scripting (XSS)

Ruby is vulnerable to cross site scripting XSS. This occurs in the homepage attribute when victim browse a malicious gem on a vulnerable gem server...

Memory Corruption

Firefox, Firefox ESR and Thunderbird are vulnerable to memory corruption. Remote unauthenticated attackers with enough effort could exploit memory safety bugs to cause memory corruption vulnerability resulting in a system crash...

Remote Code Execution (RCE)

redhat-certification is vulnerable to remote code execution RCE attacks. This is because redhat-certification does not properly sanitize paths in rhcertStore.py:saveResultsFile. A remote attacker could use this flaw to overwrite any file...

Cross-Site Scripting (XSS)

angular-froala is vulnerable to cross-site scripting XSS. The ngModel.$isEmpty function allows a remote attacker to inject arbitrary Javascript into a victim's browser since it bypasses the native froala security cleaning method by executing the content of value with the jQuery function...

Denial Of Service (DoS)

libsass.so is vulnerable to denial of service DoS. Failure to validate empty reference combinators in Inspect::operator causes an invalid memory reference, resulting in an application crash...

Denial Of Service (DoS)

Java SE and Java SE Embedded are vulnerable to denial of service attacks. A remote, unauthenticated attacker could submit malicious input leading to the exploitation of the flawed Libraries component causing partial denial of service conditions...

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service DoS. The vulnerability exists as there was an error in the uAPI interface...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. It was found that reporting emulation failures to user space could lead to either a local CVE-2014-7842 or a L2-L1 CVE-2010-5313 denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to acce...