CVE-2018-1000881

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web application request by a...

CVE-2018-7956

Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions before 4.0.5 that attackers can conduct bruteforce to the VIP App Web Services to get user information...

TIBCO Statistica Server TIBCO Statistica Component Cross-Site Scripting Vulnerability

TIBCO Statistica Server is a suite of job servers from TIBCO Software that provides a governance framework for shared workspaces and reusable templates.Statistica is one of the components... A cross-site scripting vulnerability exists in the web application of the TIBCO Statistica component in...

PowerDNS Recursor Denial of Service Vulnerability (CNVD-2018-23738)

PowerDNS Recursor aka pdnsrecursor is a domain name resolution server from the Dutch company PowerDNS. A security vulnerability exists in PowerDNS Recursor versions 4.0.0 through 4.1.4. A remote attacker can exploit this vulnerability by sending DNS queries to cause a denial of service...

CVE-2018-12412

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

CVE-2018-12415

The Central Administration server emsca component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability which may allow an attacker to perform cross-site...

Adrenalin HRMS Cross-Site Scripting Vulnerability

Adrenalin HRMS is a human resource management system from Adrenalin eSystems, India. A cross-site scripting vulnerability exists in the ApplicationtEmployeeSearch page in Adrenalin HRMS version 5.4.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the...

DEBIAN-CVE-2018-18459

The function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted pdf file, as demonstrated by pdftoppm...

DEBIAN-CVE-2018-16586

In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...

AZL-45291 CVE-2018-16335 affecting package openjpeg2 2.3.1-12

newoffsets handling in ChopUpSingleUncompressedStrip in tifdirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a...

PHP Scripts Mall advanced-real-estate-script Cross-Site Request Forgery Vulnerability

PHP Scripts Mall advanced-real-estate-script is a PHP and MySQL based real estate website system script by PHP Scripts Mall India. A cross-site request forgery vulnerability exists in PHP Scripts Mall advanced-real-estate-script version 4.0.9. A remote attacker can exploit this vulnerability to...

CVE-2018-10608

SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may cause denial of service via 100% CPU utilization. Restart of the application is required...

libgig heap buffer overflow vulnerability (CNVD-2018-15174)

libgig is a C++ library for loading, modifying existing and creating new Gigasampler .gig files and DLS downloadable sound level 1/2 files, KORG sample-based instruments .KSF and .KMP files, SoundFont v2 .sf2 files and AKAI sampler data. A heap-based buffer overflow vulnerability exists in the...

ACD Systems Canvas Draw Buffer Overflow Vulnerability (CNVD-2019-06632)

ACD Systems Canvas Draw is a graphic editing tool from ACD Systems that is used to create and edit images and more. A heap buffer overflow vulnerability exists in the TIFF parsing feature in ACD Systems Canvas Draw version 4.0.0, which can be exploited by an attacker to overwrite arbitrary data a...

UBUNTU-CVE-2018-14395

libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service application crash caused by a divide-by-zero error with a user crafted audio file when converting to the MOV audio format...

PT-2018-16263 · Acd Systems · Canvas Draw

Name of the Vulnerable Software and Affected Versions: Canvas Draw version 4.0.0 Description: An out-of-bounds write exists in the PCX parsing functionality. A specially crafted PCX image can lead to an out-of-bounds write, overwriting arbitrary data, and potentially allowing an attacker to gain...

CVE-2018-3038

Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications subcomponent: Core module. Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2018-3029

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications subcomponent: Infrastructure. Supported versions that are affected are 12.0.4, 12.1.0, 12.3.0 and 12.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

SAP Business Objects Remote Code Injection Vulnerability

SAP Business Objects is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The program provides reporting, performance management and data base and other functions. A remote code injection vulnerability exists in SAP Business Objects, version 4.0 4.1...

File Upload Vulnerability in BEESCMS Enterprise Website Management System V4.0

BEESCMS is a scalable content management system CMS based on PHP and MySQL. A file upload vulnerability exists in BEESCMS Enterprise Website Management System V4.0. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...