The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file. Date published : 2018-05-22 https://github.com/radare/radare2/commit/bd276ef2fd8ac3401e65be7c126a43175ccfbcd7 https://github.com/radare/radare2/issues/9969
The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. Date published : 2018-05-22 https://github.com/radare/radare2/commit/25a3703ef2e015bbe1d1f16f6b2f63bb10dd34f4 https://github.com/radare/radare2/commit/b35530fa0681b27eba084de5527037ebfb397422
The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. Date published : 2018-05-22 https://github.com/radare/radare2/commit/1f37c04f2a762500222dda2459e6a04646feeedf https://github.com/radare/radare2/issues/9904
The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. Date published : 2018-05-22 https://github.com/radare/radare2/commit/041e53cab7ca33481ae45ecd65ad596976d78e68 https://github.com/radare/radare2/issues/9928
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter. Date published : 2018-05-22 https://github.com/hi-KK/CVE-Hunter/blob/master/2.md
iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter. Date published : 2018-05-22 https://github.com/hi-KK/CVE-Hunter/blob/master/1.md
SkyCaiji 1.2 allows CSRF to add an Administrator user. Date published : 2018-05-22 https://github.com/zorlan/skycaiji/issues/9
An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the database via the appshomecontrollerParserController.php scode parameter. Date published : 2018-05-22 https://gitee.com/hnaoyun/PbootCMS/issues/IJZ1E
An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module. Date published : 2018-05-22 http://blog.cppcms.com/post/123
init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0. Date published : 2018-05-22 https://blog.dewhurstsecurity.com/2018/05/22/loginizer-wordpress-plugin-xss-vulnerability.html https://plugins.trac.wordpress.org/changeset/1878502/loginizer
sas/readstat_sas7bcat_read.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop. Date published : 2018-05-22 https://github.com/ChijinZ/security_advisories/tree/master/ReadStat-7bced5b
sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconv_open call. Date published : 2018-05-22 https://github.com/ChijinZ/security_advisories/tree/master/ReadStat-7bced5b
jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read. Date published : 2018-05-22 https://github.com/AndreRenaud/PDFGen/commit/ee58aff6918b8bbc3be29b9e3089485ea46ff956 https://github.com/ChijinZ/security_advisories/tree/master/PDFgen-206ef1b
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing ‘’ character. Date published :...