News aggregator

CVE-2018-17006

National Vulnerability Database - Thu, 09/13/2018 - 14:29
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for firewall lan_manage mac2.
Categories: Security News

CVE-2018-17007

National Vulnerability Database - Thu, 09/13/2018 - 14:29
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_wds_2g ssid.
Categories: Security News

CVE-2018-17008

National Vulnerability Database - Thu, 09/13/2018 - 14:29
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_host_2g power.
Categories: Security News

CVE-2018-17009

National Vulnerability Database - Thu, 09/13/2018 - 14:29
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_host_2g isolate.
Categories: Security News

CVE-2018-16999

National Vulnerability Database - Thu, 09/13/2018 - 12:29
Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to cause a denial of service via a crafted input file.
Categories: Security News

CVE-2018-17000

National Vulnerability Database - Thu, 09/13/2018 - 12:29
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Categories: Security News

CVE-2018-16741

National Vulnerability Database - Thu, 09/13/2018 - 12:29
An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.
Categories: Security News

CVE-2018-16742

National Vulnerability Database - Thu, 09/13/2018 - 12:29
An issue was discovered in mgetty before 1.2.1. In contrib/scrts.c, a stack-based buffer overflow can be triggered via a command-line parameter.
Categories: Security News

CVE-2018-16743

National Vulnerability Database - Thu, 09/13/2018 - 12:29
An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy(), which can cause a stack-based buffer overflow.
Categories: Security News

CVE-2018-16744

National Vulnerability Database - Thu, 09/13/2018 - 12:29
An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow for command injection if untrusted input can reach it, because popen is used.
Categories: Security News

CVE-2018-16745

National Vulnerability Database - Thu, 09/13/2018 - 12:29
An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow a buffer overflow if long untrusted input can reach it.
Categories: Security News

CVE-2018-16796

National Vulnerability Database - Thu, 09/13/2018 - 12:29
HiScout GRC Suite before 3.1.5 allows Unrestricted Upload of Files with Dangerous Types.
Categories: Security News

CVE-2018-1698

National Vulnerability Database - Thu, 09/13/2018 - 11:29
IBM Maximo Asset Management 7.6 through 7.6.3 could allow an unauthenticated attacker to obtain sensitive information from error messages. IBM X-Force ID: 145967.
Categories: Security News

CVE-2018-16987

National Vulnerability Database - Thu, 09/13/2018 - 11:29
Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code.
Categories: Security News

CVE-2018-15310

National Vulnerability Database - Thu, 09/13/2018 - 10:29
A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages.
Categories: Security News

CVE-2018-16985

National Vulnerability Database - Thu, 09/13/2018 - 10:29
In Lizard (formerly LZ5) 2.0, use of an invalid memory address was discovered in LZ5_compress_continue in lz5_compress.c, related to LZ5_compress_fastSmall and MEM_read32. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Categories: Security News

CVE-2018-5545

National Vulnerability Database - Thu, 09/13/2018 - 10:29
On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload.
Categories: Security News

CVE-2018-5548

National Vulnerability Database - Thu, 09/13/2018 - 10:29
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts.
Categories: Security News

CVE-2018-5549

National Vulnerability Database - Thu, 09/13/2018 - 10:29
On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements.
Categories: Security News

CVE-2018-16983

National Vulnerability Database - Thu, 09/13/2018 - 00:29
NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type value.
Categories: Security News

Pages