perfSONAR Monitoring and Debugging Dashboard Information Disclosure Vulnerability

The perfSONAR Monitoring and Debugging Dashboard MaDDash is a suite of tools for collecting two-dimensional data and presenting it visually. A security vulnerability exists in perfSONAR MaDDash. The vulnerability can be exploited to obtain directory listings and potentially disclose sensitive...

SUSE-SU-2018:1759-1 Security update for microcode_ctl

This update for microcodectl fixes the following security issue: - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction bsc1095735...

Reliable Controls® MACH-ProWebCom™ 未授权访问信息泄露

MACH-ProWebCom™ 是一个功能强大内置网络服务器完全可自由编程的BACnet® 楼宇控制器。可以快速方便地同 Reliable Controls® MACH-ProWebCom™ 将楼宇自控系统发布到网络上。 MACH-ProWebCom™ Web 服务存在未授权访问，可以下载服务配置等敏感信息 MACH-ProWebCom™, a fully programmable BACnet® Building Controller with a powerful, built-in Web server.It can post your building graphics to t...

Microsoft Windows FxCop XML External Entity Injection Vulnerability

Microsoft Windows FxCop is a code review tool for the .net platform. Microsoft Windows FxCop XML External Entity Injection vulnerability, which originates from an external entity injection error when the program processes XML data. A remote attacker could exploit this vulnerability to disclose...

PT-2018-10677

Name of the Vulnerable Software and Affected Versions PPPD versions prior to the version with the fixed patch Description The issue arises from improper input validation combined with an integer overflow in the EAP-TLS protocol implementation. This can lead to a crash, information disclosure, or...

CVE-2017-3968

Session fixation vulnerability in the web interface in McAfee Network Security Manager NSM before 8.2.7.42.2 and McAfee Network Data Loss Prevention NDLP before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie...

CVE-2017-5385

Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. This vulnerability affects Firefox 51...

CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...

DEBIAN-CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...

Privilege escalation

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...

CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...

CVE-2017-5385

Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. This vulnerability affects Firefox 51...

CVE-2017-5385

Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. This vulnerability affects Firefox 51...

CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...

Code injection

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets...

GE MDS PulseNET and MDS PulseNET Enterprise Information Disclosure Vulnerability

GE MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric GE.GE MDS PulseNET is a suite of network management software designed specifically for radio communication systems.MDS PulseNET Enterprise is its enterprise version. A security vulnerability exists in GE MDS PulseNE...

DEBIAN-CVE-2018-11737

An issue was discovered in libtskfs.a in The Sleuth Kit TSK from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfsfixidxrec in tsk/fs/ntfsdent.cpp which could be leveraged by an attacker to disclose information or manipulated to read from...

DEBIAN-CVE-2018-11697

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service...

LibSaas out-of-bounds read vulnerability (CNVD-2018-15184)

LibSaas is a C/C++ implementation of the Sass compiler. An out-of-bounds read vulnerability exists in the Sass::Prelexer::skipoverscopes function in LibSaas 3.5.4 and earlier. An attacker could use this vulnerability to obtain information or cause a denial of service...

Vgate iCar 2 Wi-Fi OBD2 Dongle Unencrypted Data Transfer Vulnerability

Vgate iCar 2 Wi-Fi OBD2 Dongle is an automotive fault detection device from VgateTechnology, China. A security vulnerability exists in the Vgate iCar 2 Wi-Fi OBD2 Dongle, which stems from the program's failure to encrypt data packets passed between the iOS or Android app and the OBD dongle, and t...