PT-2019-2245

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation affected versions not specified Microsoft SharePoint Server affected versions not specified Description The issue arises due to insufficient input validation, allowing a remote attacker to perform cross-site...

PT-2019-2248

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation and Microsoft SharePoint Enterprise Server affected versions not specified Description The issue is related to a lack of protection for service data, which can be exploited by a remote attacker to perform...

CVE-2018-16485: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

PT-2018-2052

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Enterprise Server affected versions not specified Description The issue is related to insufficient access control in Microsoft SharePoint Server, allowing a remote attacker to elevate their privileges using a specially...

GHSA-4W88-RJJ3-X7WP Chromium Remote Code Execution in electron

Affected versions of ElectronJS are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the sandbox option is enabled. Recommendation Update to electron version 1.7.8 or later...

CVE-2018-12713

GIMP through 2.10.2 makes ggettmpdir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimpwriteandreadfile function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was...

CVE-2016-5288

Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox 49.0.2...

CVE-2017-16151

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the sandbox option is enabl...

Multiple TIBCO Product Information Disclosure Vulnerabilities (CNVD-2018-10558)

TIBCO JasperReports Server and so on are the products of the United States TIBCO Software Corporation.TIBCO JasperReports Server is a report generation and editing tools for the server version of the TIBCO JasperReports Server Community Edition is the community version of it. A security...

Mozilla Firefox WebExtensions Host Privilege Bypass Vulnerability

Mozilla Firefox browser Firefox is a free and open source browser for Windows, Linux and MacOSX platforms. Mozilla Firefox suffers from a WebExtensions host privilege bypass vulnerability. An attacker can exploit this vulnerability to bypass host privilege settings via request redirection and...

CVE-2018-5166

WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. This vulnerability affects Firefox 60...

PT-2018-5383

Name of the Vulnerable Software and Affected Versions: undertow versions prior to 1.4.18.SP1 undertow versions prior to 2.0.2.Final undertow versions prior to 1.4.24.Final Description: The issue arises when using Digest authentication, as the server fails to verify that the URI in the Authorizati...

Information Disclosure Through Authorization Bypass

undertow-core is vulnerable to information disclosure attacks through authorization bypass. The vulnerability exists as undertow-core does not validate the uri attribute in the Authorization header, allowing a man-in-the-middle MitM attacker to provide a bogus uri and accessing other content on t...

PT-2018-9145

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: An issue exists where Microsoft SharePoint Server fails to properly sanitize a specially crafted web request, allowing for potential elevation of privilege. This could...

Google Patches 11 Critical Bugs in March Android Security Bulletin

Google patched 11 critical vulnerabilities in its Android operating system this week, seven of which are remote code execution bugs. In total, 37 flaws were patched, with 26 rated as high severity. The most severe of the bugs is a critical security vulnerability found in the Media Framework...

Mozilla Firefox Unauthorized Access Vulnerability (CNVD-2018-02220)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 58, which stems from the program being able to display cross-origin content when the CORS packet header is set to prohibi...

Mozilla Firefox Security Advisories (MFSA2018-02, MFSA2018-03) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox Security Advisories (MFSA2018-02, MFSA2018-03) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

DRUPAL-CONTRIB-2018-002

The Node view permissions module enables the "View own content" and "View any content" permissions for each content type on the permissions page. This module has a vulnerability that allows users with these permissions to view unpublished content that they are not otherwise authorized to view. Th...

Plone Information Disclosure Vulnerability (CNVD-2018-02150)

Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. An...