CVE-2018-3882

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger...

CVE-2018-3883

CVE-2018-3883 concerns ERPNext v10.1.6 with exploitable SQL injection in the authenticated area. The TALOS/NVD analyses confirm vulnerable parameters include employee and sort_order (and related endpoints such as _cmd=erpnext.hr.doctype.leave_application.leave_application and _cmd=erpnext.stock.d...

CVE-2018-3885

CVE-2018-3885 describes an exploitable SQL injection in the authenticated portion of ERPNext v10.1.6. The vulnerability allows injection via the order_by parameter in web requests, enabling data compromise. Exploitation can be performed using a browser (no special tools). Connected sources (Talos...

CVE-2018-3883

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...

CVE-2018-3884

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sortby and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to...

CVE-2018-3885

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The orderby parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger thes...

CVE-2018-3882

ERPNext v10.1.6 contains exploitable SQL injection vulnerabilities in the authenticated area, notably via the searchfield parameter, enabling data compromise through crafted requests. Multiple sources (NVD entry CVE-2018-3882 and TALOS reports TALOS-2018-0560, TALOSBLOG) confirm SQLi in authentic...

Microsoft Office Multiple Vulnerabilities (Sep 2018) - Mac OS X

This host is missing an important security update for Microsoft Office 2016 on Mac OS X according to Microsoft security update September 2018 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Someone Hijacked MEGA Chrome Extension to Steal Users' Passwords

Warning! If you are using Chrome browser extension from the MEGA file storage service, uninstall it right now. The official Chrome extension for the MEGA.nz cloud storage service had been compromised and replaced with a malicious version that can steal users' credentials for popular websites like...

ERPNext SQL Injection Vulnerabilities

Summary Exploitable SQL injection vulnerabilities exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required. Tested...

JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

Amazon Linux AMI : mysql55 (ALAS-2018-1068)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Options. Supported versions that are affected are 5.5.60 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

Cheddar’s Restaurants Bitten By Credit-Card Breach

Fast-casual stalwart Cheddar’s Scratch Kitchen has become the latest restaurant to suffer a payment-card breach. Cheddar’s, known for its reasonably priced country-fried chicken, pot pies, ribs and other comfort food, has hundreds of locations across the Midwest and the South. It said that it...

‘China’s MIT’ Linked to Espionage Campaign Against Alaska, Economic Partners

An extensive cyberespionage campaign was disclosed today, targeting high-value international and U.S. government agencies and companies and emanating from an IP address associated with Tsinghua University, colloquially known as “China’s MIT.” The actors have gone after a range of targets, includi...

Security Updates for Microsoft Excel Products (August 2018)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the...

coffescript is malware

The coffescript package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation If you have found coffescript installed in your...

CVE-2018-3109

CVE-2018-3109 affects Oracle Fusion Middleware MapViewer (Map Builder) in versions 12.2.1.2 and 12.2.1.3. The vulnerability exists in the MapViewer component and is exploitable by a low-privilege attacker over HTTP with network access, potentially leading to unauthorized reading of data or access...

CVE-2018-3108

CVE-2018-3108 affects Oracle Fusion Middleware (Oracle Notification Service subcomponent) in versions 12.2.1.2 and 12.2.1.3. The flaw is exploitable by a low-privileged attacker who can access the service over HTTPS and can lead to unauthorized access to data across Oracle Fusion Middleware. The ...