Cloudera Manager Redirection Vulnerability

Cloudera Manager is a suite of Hadoop data management software from Cloudera. The software supports creating clusters, authentication, data backup and recovery, and more. A security vulnerability exists in Cloudera Manager versions 5.x through 5.15.0 that stems from the program failing to check t...

CVE-2019-4069

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014...

CVE-2019-4068

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013...

PT-2019-6459 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.1.5 Description: An issue was discovered in the ip ra control function in the net/ipv4/ip sockglue.c component of the Linux kernel. This issue is related to errors in pointer dereferencing, which might allow an...

Out-of-bounds read vulnerability in multiple Apple products (CNVD-2019-02759)

Apple iOS is an operating system developed for mobile devices; watchOS is a smartwatch operating system. An out-of-bounds read vulnerability exists in the Core Media component in Apple iOS before 12.1.3, watchOS before 5.1.3, and macOS. An attacker can exploit the vulnerability to elevate...

CVE-2018-19815

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/UserPopupAddNewProp.jsp" has reflected XSS via the ConnPoolName parameter...

CVE-2018-19812

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/SubFolderPackages.jsp" has reflected XSS via the GroupId parameter...

Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07230)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the Users.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the...

Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07235)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the RolePermissions.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker with the 'ConnPoolName' parameter to inject arbitrar...

Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07222)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the /VPortal/mgtconsole/SubFolderPackages.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker to inject arbitrary web script...

Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07225)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the PresentSpace.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker to inject arbitrary web script or HTML with the help of...

DEBIAN-CVE-2018-19841

The function WavpackVerifySingleBlock in openutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service out-of-bounds read and application crash via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack...

WavPack Denial of Service Vulnerability (CNVD-2019-06791)

WavPack is an open source, free audio lossless compression software. A security vulnerability exists in the 'WavpackPackInit' function in the packutils.c file of the libwavpack.a static link library in WavPack 5.1.0 and earlier versions. An attacker can exploit this vulnerability to cause a denia...

CVE-2018-15481

Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices using firmware version 5.1.x before 5.1.13 allows authenticated remote attackers to escape the shell and escalate their privileges by adding a LocalCommand to the SSH configuration file in...

Unspecified vulnerability in hapi-auth-jwt2

hapi-auth-jwt2 is a module that supports authentication using JSON Web Tokens JWT in Hapi.js web applications. A security vulnerability exists in hapi-auth-jwt2 version 5.1.1. An attacker can exploit the vulnerability to bypass authentication...

PT-2018-9954 · Wavpack +3 · Wavpack +3

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier Description: An issue in WavPack for W64 input can cause out-of-bounds writes due to insufficient validation of unknown chunk sizes in the ParseWave64HeaderConfig function, located in wave64.c. This is relat...

CVE-2018-2836

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBo...

UBUNTU-CVE-2018-2844

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBo...

Oracle VM VirtualBox Elevation of Privilege Vulnerability (CNVD-2018-02061)

Oracle Virtualization is the American Oracle Oracle company's set of hardware and software virtualization management solutions. Oracle VM VirtualBox is one of the virtual machine components. A security vulnerability exists in the Oracle VM VirtualBox component of Oracle Virtualization, versions...

Ruby on Rails SQL Injection Vulnerability (CNVD-2018-01347)

Ruby on Rails is a Web application development framework written in the Ruby language. A SQL injection vulnerability exists in the 'reorder' method in Ruby on Rails 5.1.4 and earlier. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands via the 'name' parameter...