PT-2019-15958 · Atasm · Atasm

Name of the Vulnerable Software and Affected Versions: ATasm version 1.06 Description: The issue is a stack-based buffer overflow in the get signed expression function, located in setparse.c, which can be triggered by a crafted .m65 file. Recommendations: For ATasm version 1.06, as a temporary...

PT-2019-5529

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.10 Description The issue is related to the xmlStringLenDecodeEntities function in the libxml2 library, which can lead to an infinite loop under certain end-of-file conditions. This could allow a remote attacker to cause a...

forma.lms <= 2.2.1 Multiple SQL Injection Vulnerabilities

Forma Learning Management System is prone to multiple SQL injection vulnerabilities. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as...

CVE-2019-19523

In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79...

GHSA-5PM8-492C-92P5 Prototype Pollution in chartkick

Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as "proto": "polluted": true. It is possible to achieve the same results if a chart loads data from a malicio...

Sandbox Breakout / Prototype Pollution

Overview Versions of notevil prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload tryab;catchee.constructor.constructor'return...

PT-2019-6875 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 3.3.1 Description: The issue arises from improper validation of user input in certain files, allowing remote attackers to execute arbitrary commands. This is specifically related to the viewimage.php and barcode.lib.p...

PT-2019-6874 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 3.3.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This is due to a Cross-site Scripting XSS flaw in the functions.lib.php file. Recommendations: For Dolibarr ERP/CRM version...

UBUNTU-CVE-2016-1000236

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

Microsoft Office 2016 Information Disclosure Vulnerability (KB4484113)

This host is missing an important security update according to Microsoft KB4484113 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

eMerge E3 Access Controller 4.6.07 - Remote Code Execution Exploit

Exploit Title: eMerge E3 Access Controller 4.6.07 - Remote Code Execution Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link: http://linear-solutions.com/nscfamily/e3-series/ Version: 4.6.07 Tested on: NA CVE : CVE-2019-7265 Advisory:...

CVE-2019-15005

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the...

Avast Free Antivirus < 19.1.2360 Information Disclosure Vulnerability - Windows

Avast Free Antivirus is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

UBUNTU-CVE-2013-2024

OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0...

Adobe Media Encoder Out-of-Bounds Read Information Disclosure Vulnerability (CNVD-2019-39589)

Adobe Media Encoder is a video and audio encoding application. An out-of-bounds read information disclosure vulnerability exists in the parsing of MOV files in versions prior to Adobe Media Encoder 13.1.5. The vulnerability stems from a lack of proper validation of user-supplied data. An attacker...

IBM Security Guardium Big Data Intelligence CVE-2019-4307 Information Disclosure Vulnerability

Description IBM Security Guardium Big Data Intelligence is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. IBM Security Guardium Big Data Intelligence 4.0 is vulnerable. Technologies Affected IBM...

Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting...

NETGEAR JNR1010 Cross-Site Request Forgery Vulnerability

The NETGEAR JNR1010 is a wireless router from NETGEAR. A cross-site request forgery vulnerability exists in the NETGEAR JNR1010 prior to version 1.0.0.32. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user, and can be...

CVE-2019-2936

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Difficult to exploit vulnerability allows low privileged attacker having Admin - Configuration privilege with network access via HTT...

Adobe Acrobat Reader DC (Classic Track) Security Updates (APSB19-49) - Windows

Adobe Acrobat Reader DC Classic 2015 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...