CVE-2018-2981

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications subcomponent: Infrastructure. Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0, 12.4.0, 14.0.0 and 14.1.0. Easily exploitable...

CVE-2018-2948

Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products subcomponent: Web Runtime. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOn...

CVE-2018-3017

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Preferences. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2018-3006

Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products subcomponent: Web Runtime. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOn...

PT-2018-15953

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Products Suite version 12.2.2 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Ops Center, resulting in unauthorized access to critical data or...

CVE-2018-3066

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Options. Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocol...

Design/Logic Flaw

The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for Linux and Mac OS X runs as a privileged process and can allow an unprivileged user to assume super-user privileges on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information,...

CVE-2018-5529

The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for Linux and Mac OS X runs as a privileged process and can allow an unprivileged user to assume super-user privileges on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information,...

Security Bulletin: Multiple security vulnerabilities affect the Report Builder that is shipped with Jazz Reporting Service (CVE-2015-7464, CVE-2015-7467, CVE-2015-7468, CVE-2015-7469, CVE-2015-7470)

Summary There are multiple security vulnerabilities in the Report Builder component shipped with Jazz Reporting Service. Vulnerability Details CVEID: CVE-2015-7464 DESCRIPTION: IBM Jazz Reporting Server JRS could allow an attacker that knows the URL of a Report Builder instance to perform an...

Security Bulletin: Multi-Cloud Data Encryption (MDE) is affected by a missing checksum vulnerability

Summary Security Bulletin: Multi-Cloud Data Encryption MDE has addressed a missing checksum vulnerability Vulnerability Details CVEID: CVE-2018-1593 DESCRIPTION: IBM Multi-Cloud Data Encryption MDE could allow an unauthorized user to manipulate data due to missing file checksums. CVSS Base Score:...

CVE-2018-1085

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCDCLIENTCERTAUTH and ETCDPEERCLIENTCERTAUTH in etcd.conf result in etcd being configured to allow remote users...

Code injection

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices...

CVE-2018-10363

The CVE-2018-10363 entry applies to the WordPress plugin “Booking calendar, Appointment Booking System” by WpDevArt, version 2.2.2. The vulnerability is described as an issue where multiple parameters can be manipulated by a remote attacker to change data such as prices. The connected documents c...

CVE-2018-10363: Improper Input Validation

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices...

Node.js third-party modules: [exceljs] Possible XSS via cell value when worksheet is displayed in browser

Hi Team, I would like to report Stored XSS vulnerability in exceljs module. It allows to execute JavaScript code embeded in the XLS sheet when data from the sheet are displayed in the browser. Module module name: exceljs version: 1.4.6 npm page: https://www.npmjs.com/package/exceljs Module...

IBM StoredIQ Elevation of Privilege Vulnerability

IBM StoredIQ is a suite of data visualization and processing platforms from IBM, USA. The platform provides scalable analytics and governance of unstructured data, as well as records management, storage optimization and migration of data. A security vulnerability exists in IBM StoredIQ version 7....

Oracle Fusion Middleware WebCenter Content Component Unauthorized Operation Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's business innovation platform for enterprise and cloud environments, which provides middleware, software collections, etc. WebCenter Content is one of the components of the enterprise content management solution. A security...

BD Pyxis

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Public exploits are available. Vendor : Becton, Dickinson and Company BD Equipment : Certain BD Pyxis Products Vulnerability : Reusing a Nonce 2. RISK EVALUATION Successful exploitation of this vulnerability could allow data traffic manipulation,...

CVE-2018-2791

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware subcomponent: Advanced UI. Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2018-2770

Vulnerability in the Oracle Adaptive Access Manager component of Oracle Fusion Middleware subcomponent: OAAM Admin. The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Adaptive Acce...