CVE-2018-1605

Summary : CVE-2018-1605 affects IBM Rational Quality Manager (RQM) 5.0–5.02 and 6.0–6.0.6, introducing a cross-site scripting (XSS) vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. The root cause is input handling in the Web UI that allows embedding of...

CVE-2018-1440

CVE-2018-1440 affects IBM Rational Quality Manager (RQM) 5.0–5.02 and 6.0–6.0.6, where a cross-site scripting flaw in the Web UI could let an attacker embed arbitrary JavaScript, potentially disclosing credentials within a trusted session. Remediation per IBM includes upgrading to 5.0.2 iFix27 or...

CVE-2018-1403

CVE-2018-1403 affects IBM Rational Quality Manager (RQM) versions 5.0–5.0.2 and 6.0–6.0.6. The issue is a cross-site scripting flaw in the Web UI that lets an attacker embed arbitrary JavaScript, potentially leading to credentials disclosure in a trusted session. Root cause: improper sanitization...

CVE-2018-1601

IBM Rational Quality Manager RQM 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-16586

In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...

CVE-2018-16586

In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...

CVE-2018-16586

In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...

CVE-2018-1610

IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

CVE-2018-1610

IBM Rational DOORS Next Generation (RDNG) versions affected: 5.0–5.0.2 and 6.0–6.0.6. The vulnerability is a cross-site scripting flaw in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Root cause details...

CVE-2018-1588

The CVE-2018-1588 entry concerns IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0–5.0.2 and 6.0–6.0.6) with a XML External Entity (XXE) vulnerability when processing XML data. Underlying issue: XXE allow remote attackers to exfiltrate sensitive information or consume memory res...

websockets is vulnerable to denial of service by memory exhaustion

The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable...

GHSA-6G87-FF9Q-V847 websockets is vulnerable to denial of service by memory exhaustion

The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable...

CVE-2018-1791

IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting suitable payloads, an attacker could exploit this vulnerability to induce the Connections server to attack other systems. IBM X-Force ID:...

CVE-2018-1791

CVE-2018-1791 affects IBM Connections versions 5.0, 5.5, and 6.0. The vulnerability stems from improper validation of a request property, enabling an External Service Interaction where an attacker could cause the Connections server to attack other systems. Public sources (NVD/IBM X-Force) assign ...

Privilege escalation

Escalation of privilege in Reference UI in Intel Data Center Manager SDK 5.0 and before may allow an unauthorized remote unauthenticated user to potentially execute code via administrator privileges...

CuteFTP 5.0 - Buffer Overflow Exploit

Exploit for windows platform in category local exploits Exploit Title: CuteFTP 5.0 - Buffer Overflow Author: Matteo Malvica Vendor homepage: www.globalscape.com Software: CuteFTP 5.0.4 XP - build 54.8.6.1 Software Link: http://installer.globalscape.com/pub/cuteftp/archive/english/cuteftp50.exe...

CuteFTP 5.0 - Buffer Overflow

CuteFTP 5.0 - Buffer Overflow...

PT-2018-12707 · Kamailio +2 · Kamailio +2

Name of the Vulnerable Software and Affected Versions: Kamailio versions prior to 5.0.7 Kamailio versions 5.1.x prior to 5.1.4 Description: A crafted SIP message with a double "To" header and an empty "To" tag can cause a segmentation fault and crash due to missing input validation in the build r...

Oracle GlassFish 5.0 Demo Feature Default Credentials Vulnerability

Oracle GlassFish Server is using default credentials for the demo feature. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-6564 Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a remote attacker to execute arbitrary code with root privileges

Android devices with code from Ragentek contain a privileged binary that performs over-the-air OTA update checks. Additionally, there are multiple techniques used to hide the execution of this binary. This behavior could be described as a rootkit. This binary, which resides as /system/bin/debugs,...