CVE-2018-1000411

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result...

CVE-2018-5738 Some versions of BIND can improperly permit recursive query service to unauthorized clients

Change 4777 introduced in October 2017 introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended and documented behavior is that if an operator has not specified a value for the...

Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation

Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation Windows: XmlDocument Insecure Sharing Elevation of Privilege Platform: Windows 10 1809 almost certainly earlier versions as well. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria:...

Joomla! cross-site scripting vulnerability (CNVD-2019-14555)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in the Global Configuration textfilte...

CVE-2018-1000411

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result...

CVE-2018-1000411: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result...

Fedora 28 : 1:epiphany (2018-a5e45fc9f7)

Fix CVE-2018-11396/CVE-2018-12016 795740 - Allow Ctrl+T in app mode again due to unintended consequences 796204 - Don't remember passwords when the setting is disabled 796219 - Fix password manager crash on chase.com GitLab 11 Note that Tenable Network Security has extracted the preceding...

Design/Logic Flaw

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

CVE-2018-18959

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

CVE-2018-18959

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

CVE-2018-18959

The CVE-2018-18959 issue affects Epson WorkForce WF-2861 devices (10.48 LQ22I3, 10.51.LQ20I6, 10.52.LQ17IA). On the Air Print Setting page, if the data for Bonjour Service Location at /PRESENTATION/BONJOUR exceeds 251 bytes during data submission, the device becomes unusable until a reboot. This ...

PT-2018-15375 · Telegram · Telegram

Name of the Vulnerable Software and Affected Versions: Telegram version 4.9.1 Telegram Web-version 0.7.0 Description: The issue concerns a side channel in the "secret chat" feature where Telegram servers send GET requests for URLs typed while composing a chat message, before the message is sent...

CVE-2018-18959: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

PT-2018-14743

Name of the Vulnerable Software and Affected Versions Epson WorkForce WF-2861 versions 10.48 LQ22I3, 10.51.LQ20I6, 10.52.LQ17IA Description An issue was discovered where the device no longer functions until a reboot when the data for 'Bonjour Service Location' at the "/PRESENTATION/BONJOUR" API...

Moxa NPort W2x50A Operating System Command Injection Vulnerability

Moxa NPort W2x50A is a Moxa serial communication server for connecting industrial serial devices to a network. An operating system command injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware prior to version 2.2 Build18082311. An attacker can...

PT-2018-15031 · Hashicorp +1 · Hashicorp Consul +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul versions 0.5.1 through 1.4.0 Description: The issue arises from the improper documentation of the verify outgoing setting, allowing HashiCorp Consul to use cleartext agent-to-agent RPC communication. This affects versions 0.5...

Design/Logic Flaw

Inappropriate setting of the SEEMASKFLAGNOUI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page...

CVE-2018-19693

An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...

Intel DCI Policy Update - US

Lenovo Security Advisory: LEN-23611 Potential Impact: Privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2018-3652 Summary Description: Intel is releasing Direct Connect Interface DCI policy update. Existing UEFI setting restrictions for...

CVE-2018-19531

HTTL aka Hyper-Text Template Language through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEncoder unsafely when configured without an xml.codec= setting...