Google Chrome Proxy Unauthorized Access Vulnerability

Google Chrome is a web browser developed by Google, Inc. and Proxy is one of the proxy components. A security vulnerability exists in Proxy in Google Chrome versions prior to 71.0.3578.80, which stems from insufficient policy enforcement. The vulnerability can be exploited to gain unauthorized...

CVE-2018-9084

In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...

CVE-2018-9073

Lenovo Chassis Management Module CMM prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets...

Nextcloud Server Privilege Authentication Vulnerability (CNVD-2019-18774)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform.Nextcloud Server is one of the server version. A privilege validation vulnerability exists in versions of Nextcloud Server prior to 14.0.0 that can be exploited by an attacker to bypa...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2018-21847)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 63. A remote attacker could exploit this vulnerability to cause a denial of service...

chromium-browser: URL spoof in Omnibox

Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

GHSA-P699-3WGC-7H72 org.apache.tika:tika-parsers has an Infinite Loop vulnerability

Versions of the package org.apache.tika:tika-parsers before version 1.18 are vulnerable to Denial of Service DoS via a carefully crafted or fuzzed file that can trigger an infinite loop via the ChmParser...

UBUNTU-CVE-2018-3292

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

ALPINE-CVE-2018-16737

tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation...

CVE-2018-6049

Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is granted via a crafted HTML page...

CVE-2018-6501

Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center ArcMC for versions prior to 2.81. This vulnerability could be exploited to allow for insufficient access controls...

Apple iOS and tvOS Messages and Safari Information Disclosure Vulnerability

Apple iOS and tvOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. tvOS is an operating system for smart TVs. messages is a messaging component; Safari is a browser component. A security vulnerability exists in the Messages component in Apple iOS...

MyBB Cross-Site Scripting Vulnerability (CNVD-2018-19562)

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is easy to use , multi-language support , scalable , etc. Visual Editor is one of the HTML editor component . A cross-site scripting vulnerability exists in Visual Editor in...

UBUNTU-CVE-2017-15416

Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read...

CloudBees jenkins-email-ext Email Extension plugin information disclosure vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . jenkins-email-ext is...

CVE-2018-7072

A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24...

CVE-2018-14858

An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spidertools.class.php does not block private and reserved IP addresses such as 10.0.0.0/8. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14514...

Symantec Norton App Lock Privilege Gain Vulnerability

Symantec Norton App Lock is a suite of applications from Symantec USA that provide security features for mobile devices. A security vulnerability exists in versions prior to Symantec Norton App Lock 1.3.0.332. An attacker could use this vulnerability to bypass the application and prevent the...

CVE-2018-13860

MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obtain sensitive information via the "/xml/menu/getObjectEditor.xml" URL, using a "?oid=systemSetup&id=0" or "?oid=systemUsers&id=0" GET...

VulnCheck KEV: CVE-2012-5959

Stack-based buffer overflow in the uniqueservicename function in ssdp/ssdpserver.c in the SSDP parser in the portable SDK for UPnP Devices aka libupnp, formerly the Intel SDK for UPnP devices before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN aka uuid field...