Read Time:8 Second
LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.
Category Archives: Advisories
CVE-2015-10004
Read Time:11 Second
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
CVE-2015-10005
Read Time:22 Second
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
CVE-2018-25049
Read Time:18 Second
A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.
A Vulnerability in KSMBD for Linux Could Allow for Remote Code Execution
Read Time:32 Second
A vulnerability have been discovered in KSMBD for Linux that could allow for remote code execution. KSMBD is a Linux kernel daemon which implements the SMB3 protocol in kernel space for sharing files over a network. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of a remote unauthenticated user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
DSA-5306 gerbv – security update
Read Time:10 Second
Several vulnerabilities were discovered in gerbv, a Gerber file viewer,
which could result in the execution of arbitrary code, denial of service
or information disclosure if a specially crafted file is processed.
CVE-2018-16135
Read Time:7 Second
The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site.
CVE-2019-11851
Read Time:14 Second
The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overflow.
CVE-2019-19030
Read Time:10 Second
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
CVE-2019-13988
Read Time:8 Second
Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing).