PT-2018-10747 · Lutron · Stanza Lutron Integration Protocol

Name of the Vulnerable Software and Affected Versions: Stanza Lutron integration protocol versions Revision M through Revision Y Description: The issue allows attackers to gain total super user control of an IoT device through a TELNET session. This is made possible by default and unremovable...

[ASA-201806-1] git: multiple issues

Arch Linux Security Advisory ASA-201806-1 ========================================= Severity: Critical Date : 2018-06-01 CVE-ID : CVE-2018-11233 CVE-2018-11235 Package : git Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-711 Summary ======= The package git before...

Nocturnal Stealer Lets Low-Skilled Cybercrooks Harvest Sensitive Info

The Nocturnal Stealer malware has crept into the Dark Web like a thief in the night, offering criminals a lucrative payday for a small price — and little effort. It’s a commodity malware, debuting on an underground forum in March for the low price of $25. It steals things, including 28 different...

CVE-2018-11432

The mobiparsemobiheader function in read.c in Libmobi 0.3 allows remote attackers to cause information disclosure heap-based buffer over-read via a crafted mobi file...

CVE-2018-11439

CVE-2018-11439 affects TagLib 1.11.1’s Ogg FLAC scanning code (TagLib::Ogg::FLAC::File::scan in oggflacfile.cpp). The vulnerability is a heap-based buffer over-read exposed by processing a crafted audio file, leading to information disclosure. Public‑facing references in connected documents indic...

alarm.meteo-info.be XSS vulnerability

Open Bug Bounty ID: OBB-623513 Description| Value ---|--- Affected Website:| alarm.meteo-info.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Vulnerability

Exploit for hardware platform in category web applications Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on: Windows CVE: - Class...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4114)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4114 advisory. - KVM: SVM: Move spec control call after restore of GS Thomas Gleixner CVE-2018-3639 - x86/bugs: Fix the parameters alignment and missing void Konr...

radare2 denial of service vulnerability (CNVD-2018-12199)

Radare2 is a complete framework for reverse engineering and analyzing binaries, consisting of a series of small utilities that can be used together or independently of the command line. A denial of service vulnerability exists in the getdebuginfo function in radare2 2.5.0. A remote attacker can...

CVE-2018-11328

An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances a redirect issued with a URI containing a username and password when the Location: header cannot be used, a lack of escaping the user-info component of the URI could result in an XSS vulnerability...

CVE-2018-4921

Adobe Connect

Advantech WebAccess Node BWSCADASoap PointList SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess Node. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

DEBIAN-CVE-2018-11129

The header::addINFOdescriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via a crafted vcf file...

UBUNTU-CVE-2018-11129

The header::addINFOdescriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via a crafted vcf file...

UBUNTU-CVE-2018-11099

The header::addINFOdescriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure heap-based buffer over-read via a crafted vcf file...

info-financiere.fr XSS vulnerability

Open Bug Bounty ID: OBB-617674 Description| Value ---|--- Affected Website:| info-financiere.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SUSE-SU-2018:1308-1 Security update for kvm

This update for kvm fixes the following issues: This update has the next round of Spectre v2 related patches, which now integrates with corresponding changes in libvirt. A January 2018 release of qemu initially addressed the Spectre v2 vulnerability for KVM guests by exposing the spec-ctrl featur...

CVE-2018-10736

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter...

Foxit Reader and Foxit PhantomPDF Heap Buffer Overflow Vulnerability

Foxit Reader is a PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF is a commercial version. A heap buffer overflow vulnerability exists in the parsing of BITMAPINFOHEADER records for BMP files in Foxit Reader versions prior to 9.1 and Foxit PhantomPDF versions...

Inteno IOPSYS 2.0 - 4.2.0 p910nd - Remote Command Execution Exploit

Exploit for hardware platform in category remote exploits ''' Any authenticated user can modify the configuration for it in a way which allows them to read and append to any file as root. This leads to information disclosure and remote code execution. This vulnerability has been assigned the CVE...