PT-2018-11201

Name of the Vulnerable Software and Affected Versions RSA Authentication Manager Security Console versions 8.3 and earlier Description The issue allows admin users to potentially cause a denial of service or extract server data by injecting a maliciously crafted DTD in an XML file submitted to th...

CVE-2018-1247: Improper Restriction of XML External Entity Reference

RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity XXE vulnerability. This could potentially allow admin users to cause a denial of service or extract server data via injecting a maliciously crafted DTD in an XML file submitted to the application...

source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation...

source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation...

PT-2018-17627

Name of the Vulnerable Software and Affected Versions plays.tv service versions prior to 1.27.7.0 Description The issue concerns an HTTP message parsing function in the plays service.exe that writes non-user controlled data as SYSTEM to a file when the extract files parameter is used, without...

tcpdump: Heap buffer overflow in the EXTRACT_16BITS function

tcpdump 4.9.0 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via crafted packet data. The crash occurs in the EXTRACT16BITS function, called from the stpprint function for the Spanning Tree Protocol...

Diggy - Extract Enpoints From APK Files

Diggy can extract endpoints/URLs from apk files. It saves the result into a txt file for further processing. Dependencies apktool Usage ./diggy.sh /path/to/apk/file.apk You can also install it for easier access by running install.sh After that, you will be able to run Diggy as follows: diggy...

CVE-2018-8711

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

Input validation

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

CVE-2018-8711

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

PT-2018-18591

Name of the Vulnerable Software and Affected Versions WooCommerce Products Filter plugin versions prior to 2.2.0 Description A local file inclusion issue was discovered due to the lack of args/input validation on the render html function before allowing it to be called by the extract function, a...

CVE-2018-8711: Improper Input Validation

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

[SECURITY] Fedora 26 Update: freexl-1.0.5-1.fc26

FreeXL is a library to extract valid data from within an Excel spreadsheet .xls Design goals: simple and lightweight stable, robust and efficient easily and universally portable completely ignore any GUI-related oddity...

DEBIAN-CVE-2018-7648

An issue was discovered in mj2/opjmj2extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line...

CVE-2018-1000054

Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

CVE-2018-1000055

Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

PT-2018-9243

Name of the Vulnerable Software and Affected Versions: Jenkins JUnit Plugin versions 1.23 and earlier Description: The issue allows attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks by processin...

CVE-2018-1000056: Improper Restriction of XML External Entity Reference

Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

PT-2018-9241

Name of the Vulnerable Software and Affected Versions: Jenkins CCM Plugin versions 3.1 and earlier Description: The issue allows attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks by processing X...

PT-2018-9242

Name of the Vulnerable Software and Affected Versions: Jenkins Android Lint Plugin versions 2.5 and earlier Description: The issue allows attackers with user permissions to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks by processing XML...