Monthly Archive: February 2019

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit...

In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that...

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis. Date published : 2019-02-01 https://github.com/Pylons/colander/issues/290 https://github.com/Pylons/colander/pull/323

Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attackers to cause a Denial of Service (DoS) in NFS and SMB environments. Exploitation of this vulnerability will...

LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data exfiltration. Date published : 2019-02-01 http://www.securityfocus.com/bid/106634 https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01

LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code execution, data exfiltration, or cause a system crash. Date...

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL. Date published : 2019-02-01 https://hackerone.com/reports/432600

A prototype pollution vulnerability was found in module extend

A prototype pollution vulnerability was found in node.extend

A prototype pollution vulnerability was found in module mpath

A prototype pollution vulnerability was found in just-extend

A prototype pollution vulnerability was found in lodash

A prototype pollution vulnerability was found in defaults-deep

Path Traversal vulnerability in module m-server