9434 matches found
CVE-2018-3108
Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware subcomponent: Oracle Notification Service. Supported versions that are affected are 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to...
PT-2018-16033
Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 12.2.1.2 and 12.2.1.3 Description The issue allows a low-privileged attacker with network access via HTTPS to compromise Oracle Fusion Middleware, resulting in unauthorized access to critical data or complete...
CVE-2018-3108: Undefined Security Weakness
Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware subcomponent: Oracle Notification Service. Supported versions that are affected are 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to...
CVE-2018-13280
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...
CVE-2018-13280
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...
Design/Logic Flaw
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...
CVE-2018-13280
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...
CVE-2018-13280
CVE-2018-13280 affects Synology DiskStation Manager (DSM) prior to version 6.2-23739. The root cause is the use of insufficiently random values in SYNO.Encryption.GenRandomKey, which can allow remote attackers to perform a man-in-the-middle attack on non-HTTPS sessions. Practical impact stated is...
Samsung SmartThings Hub video-core RTSP Configuration Command Injection Vulnerability(CVE-2018-3856)
Summary An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this...
CVE-2018-13280: Use of Insufficiently Random Values
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...
Samsung SmartThings Hub hubCore Google Breakpad backtrace.io information disclosure vulnerability(CVE-2018-3927)
Summary An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to...
New Android P includes several security improvements
According to the Android developer Program Overview, the next major version of Android, Android 9.0 or P, is set to arrive soon. Their plans show a final release within the next three months Q3 2018. The end of the Android P beta program is approaching, with the first release candidate built and...
Denial of Service in https-proxy-agent
Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options proxy.auth being passed to Buffer. Recommendation Update to version 2.2.0 or later...
GHSA-8G7P-74H8-HG48 Denial of Service in https-proxy-agent
Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options proxy.auth being passed to Buffer. Recommendation Update to version 2.2.0 or later...
@getty.io/taskapp (>=1.2.1, <=1.2.7), bbc-a11y (>=2.1.0, <=2.2.1) +9 more potentially affected by CVE-2018-3739 via https-proxy-agent (>=2.0.0, <=2.1.1)
https-proxy-agent NPM version =2.0.0, =1.2.1, =2.1.0, =2.0.0, =1.0.1, =0.8.0, =1.12.0, =1.12.0-beta.1576, =1.15.0-beta.1701 - request-light 0.2.2 - shippable-bbs-oauth 0.9.22 Source cves: CVE-2018-3739 Source advisory: OSV:GHSA-8G7P-74H8-HG48...
PT-2018-16160
Name of the Vulnerable Software and Affected Versions https-proxy-agent versions prior to 2.2.0 Description The issue is related to a denial of service caused by unsanitized options, specifically proxy.auth, being passed to Buffer. Recommendations Update to version 2.2.0 or later...
Samsung SmartThings Hub video-core RTSP Configuration Command Injection Vulnerability
Summary An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this...
Chaturbate: Login form on non-HTTPS page on http://stream.highwebmedia.com/auth/login/
Dear Team, Summary A page on a http://stream.highwebmedia.com/auth/login/ is not fully protected by an SSL certificate. This could allow an attacker in a Man-in-the-Middle position to obtain usernames and passwords of users visiting the site. Note the warning in screenshot 1, firefox has identifi...