Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Wget vulnerability (USN-3643-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3643-1 advisory. It was discovered that Wget incorrectly handled certain inputs. An attacker could possibly use this to inject arbitrary cookie values...

CVE-2018-2415

SAP NetWeaver Application Server Java Web Container and HTTP Service Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50 do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are...

php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zendinidoop function in Zend/zendiniparser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input...

CVE-2017-17889

Kliqqi CMS 3.5.2 is affected by CVE-2017-17889, with cross-site scripting via crafted input in pligg/groups.php (group name), profile Homepage field, or Tags/Description in pligg/submit.php. The vulnerability is documented across multiple sources (NVD/CNVD) and describes XSS that can be triggered...

USN-3626-1: Ruby vulnerabilities

It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. CVE-2018-6914 It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. CVE-2018-8778,...

USN-3621-1: Ruby vulnerabilities

It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. CVE-2018-1000073 It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. CVE-2018-1000074 It w...

IBM Virtual Security Operations Center (VSOC) Cross Site Scripting

Exploit Title: IBM Virtual Security Operations Center VSOC - Cross Site Scripting XSS Date: August 2, 2018 Portal Link: https://portal.sec.ibm.com Exploit Author: Kushal Jaisingh Contact: https://ca.linkedin.com/in/kushaljaisingh Category: WebApps, XSS 1. Description Below are the steps to...

CVE-2018-8894

In 2345 Security Guard 3.6, the driver file 2345BdPcSafe.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222108...

CVE-2018-2399

Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs...

Cross site scripting

In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console CMC does not sufficiently encode user controlled inputs which results in Cross-Site Scripting...

CVE-2018-2399

Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs...

Regular Expression Denial of Service (ReDoS)

Overview django-cacheops is an app that supports automatic or manual queryset caching and automatic granular event-driven invalidation. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS attacks. This can cause an impact of about 10 seconds matching tim...

PHP Scripts Mall Multilanguage Real Estate MLM Script Cross Site Scripting Vulnerability

PHP Scripts Mall Multilanguage Real Estate MLM Script is a set of real estate online sales website scripts by PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall Multilanguage Real Estate MLM Script version 3.0. The vulnerability can be exploited by a remote...

PHP Scripts Mall Naukri Clone Script Cross-Site Scripting Vulnerability

PHP Scripts Mall Naukri Clone Script is an online recruitment system script based on PHP and MySQL platform by PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall Naukri Clone Script version 3.0.3. The vulnerability can be exploited by a remote attacker to inje...

CVE-2018-6775

In Jiangmin Antivirus 16.0.0.100, the driver file KrnlCall.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x990081C8...

PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal

Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer Directory Trasversal / Local File Inclusion Date: 08/14/2017 Software Link: http://www.pacsone.net/download.htm Google Dork: inurl:pacs/login.php inurl:pacsone/login.php inurl:pacsone filetype:php home inurl:pacsone filetype:php login Version:...

USN-3547-1 libtasn1-6 vulnerabilities

It was discovered that Libtasn1 incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2017-10790 It was discovered that Libtasn1...

CVE-2018-6209

In Max Secure Anti Virus 19.0.3.019,, the driver file MaxCryptMon.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x220019...

CVE-2018-6204

In Max Secure Anti Virus 19.0.3.019,, the driver file SDActMon.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x220019...

UBUNTU-CVE-2018-5098

A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.6, Firefox ESR 52.6, and Firefox 58...