Zyxel NAS 326 Directory Traversal Vulnerability

The Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel. A directory traversal vulnerability exists in the File Browser component of the Zyxel NAS 326 5.21 and earlier versions. A low-privileged user can exploit this vulnerability to change the location of any other user's files...

CVE-2018-1623

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 144408...

Hackers Steal $19 Million From Bithumb Cryptocurrency Exchange

Hackers yesterday stole nearly $19 million worth of cryptocurrency from Bithumb , the South Korea-based popular cryptocurrency exchange admitted today. According to Primitive Ventures' Dovey Wan, who first broke the information on social media, hackers managed to compromise a number of Bithumb's...

Override access vulnerability in de*** module of LaySNS lightweight content community system of Wuhan ClassSen Technology

LaySNS is a lightweight, integrated content management and community interaction website management system based on ThinkPHP+Layui architecture. A vulnerability exists in the de module of the LaySNS lightweight content community system in Wuhan Classen Technology. The vulnerability stems from the...

Unauthorized access vulnerability in the re**** module of LaySNS lightweight content community system of Wuhan Classen Technology

LaySNS is a lightweight, integrated content management and community interaction website management system based on ThinkPHP+Layui architecture. An unauthorized access vulnerability exists in the re module of the LaySNS lightweight content community system of Wuhan Classen Technology. The...

Design/Logic Flaw

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability such as administrators/managers can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped whe...

CVE-2018-17493

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Fullscreen button. By visiting the kiosk and clicking the full screen button in the bottom right, an attacker could exploit this vulnerability to close the program and launch other...

CVE-2019-8376

An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function getlayer4v6 located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service Segmentation fault or possibly have...

CVE-2018-17542

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the selectmid parameter in an letgo.cgi request...

GHSA-PJXW-22XF-6PWC Prototype Pollution in defaults-deep

All versions of defaults-deep are vulnerable to prototype pollution. Provided certain input defaults-deep can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation As no patch is currently available for this vulnerability it is our...

The vulnerability of the fusermount module in file system drivers for UNIX-like operating systems allows a attacker to cause a service failure or other unpredictable behavior.

The vulnerability of the fusermount driver for file systems in UNIX-like operating systems relates to circumventing a limitation under SELinux’s mandatory access control policy. This allows users without root privileges to mount the FUSE file system with the “allowother” mount option, regardless ...

The vulnerability of the pnp-save.sh service on the TeNIX programmable logic controllers MFC1500 and MFC3000 allows a hacker to read data stored by other users on the device.

The vulnerability of the pnp-save.sh service in the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to remotely read data stored by other users on the devic...

UBUNTU-CVE-2018-3309

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

CVE-2018-16888

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user e.g. User field set in the service file, a local attacker who is able to write to the PIDFile of the mentioned service may use this fl...

UBUNTU-CVE-2018-16888

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user e.g. User field set in the service file, a local attacker who is able to write to the PIDFile of the mentioned service may use this fl...

CVE-2017-9732

The readpacket function in knc Kerberised NetCat before 1.11-1 is vulnerable to denial of service memory exhaustion that can be exploited remotely without authentication, possibly affecting another services running on the targeted host...

CVE-2018-1000833

ZoneMinder version = 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c

An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used...

PT-2018-16356 · Signal · Signal Messenger For Android

Name of the Vulnerable Software and Affected Versions: Signal Messenger for Android version 4.24.8 Description: The issue may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in...

Amazon Linux 2 : fuse (ALAS-2018-1123)

A vulnerability was discovered in fuse. When SELinux is active, fusermount is vulnerable to a restriction bypass. This allows non-root users to mount a FUSE file system with the 'allowother' mount option regardless of whether 'userallowother' is set in the fuse configuration. An attacker may use...