PT-2018-2622 · Apache +1 · Apache Openoffice +2

Name of the Vulnerable Software and Affected Versions: Apache Open Office versions 4.1.5 and earlier Description: The issue is related to an arithmetic overflow that occurs when loading a document with a smaller end line termination than the operating system uses. This defect can cause the softwa...

CVE-2018-9208

Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut = v1.1Beta...

CVE-2018-18517

Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS...

CVE-2018-18417

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...

CVE-2018-18393

Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

LAquis SCADA Out-of-Bounds Read Vulnerability

LAquis SCADA is a suite of SCADA software for monitoring and data acquisition. An out-of-bounds read vulnerability exists in LAquis SCADA version 4.1.0.3870 and earlier versions that can be exploited by remote attackers to execute code...

Apache Tika Denial of Service Vulnerability (CNVD-2018-20684)

Apache Tika is the United States Apache Apache Software Foundation, an integrated POI using Java programs to provide read and write Microsoft Office format documents open-source library, Pdfbox read and create PDF documents pure Java class library and for text extraction work provides a unified...

SQL Injection Vulnerability in Five Fingers CMS v4.1.0

Five fingers CMS is a high-performance open source content management system , support for LNAMP architecture . Five Fingers CMS v4.1.0 SQL injection vulnerability exists , the vulnerability stems from the failure to filter ca.php file in the groupname parameter , an attacker can use the...

CVE-2018-8850

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software does not validate input properly, allowing an attacker to craft the input in a form that is not expected by the rest of the application. This would lead to parts of the unit receiving unintended input, which may result ...

CVE-2018-1785

IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 148870...

PT-2018-13961 · Videolan · Libmp4V2

Name of the Vulnerable Software and Affected Versions: libmp4v2 version 2.1.0 Description: The issue arises from the function MP4Free in mp4property.cpp, which internally calls free on an invalid pointer. This results in a SIGABRT signal being raised. Recommendations: For libmp4v2 version 2.1.0,...

ALPINE-CVE-2018-17082

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the phphandler function in sapi/apache2handler/sapiapache2.c...

Contiki-NG Buffer Over-Read Vulnerability

Contiki-NG is an open source cross-platform operating system for next-generation IoT devices. A buffer over-read vulnerability exists in lookup in os/storage/antelope/lvm.c in Contiki-NG 4.1 and earlier versions when parsing AQL, which can be exploited by an attacker to cause a denial of service...

PT-2018-5060 · Information Builders · Webfocus Business Intelligence Portal

Name of the Vulnerable Software and Affected Versions: Information Builders WebFOCUS Business Intelligence Portal version 8.1 Description: A command execution issue exists due to a specially crafted web parameter that can cause command injection. An authenticated attacker can exploit this by...

e107 Cross-Site Request Forgery Vulnerability (CNVD-2018-17620)

e107 is an open source, free and PHP and MySQL based Content Management System CMS developed by the e107 team. The system supports a variety of plug-ins and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A cross-site request forgery...

SAP BusinessObjects Business Intelligence Admin Tools Information Disclosure Vulnerability

SAP BusinessObjects Business Intelligence is a suite of business intelligence software and enterprise performance solutions from SAP. The product features report generation, analysis, data visualization, etc. Admin Tools is one of the management tools. An information disclosure vulnerability exis...

Philips IntelliSpace Cardiovascular and Xcelera Privilege Mismanagement Vulnerability

Philips IntelliSpace Cardiovascular ISCV and Xcelera are both products of the Dutch company Philips.Philips ISCV is a cardiac imaging information management system.Xcelera is its predecessor. A security vulnerability exists in Philips ISCV version 2.x and earlier and Xcelera version 4.1 and...

CVE-2018-15481

Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices using firmware version 5.1.x before 5.1.13 allows authenticated remote attackers to escape the shell and escalate their privileges by adding a LocalCommand to the SSH configuration file in...

Citrix XenServer Directory Traversal Vulnerability

Citrix XenServer is an open source virtualization platform for managing cloud, server and desktop virtual infrastructures from Citrix Systems. The platform provides virtual machine monitoring, management and maintenance through an intuitive interface. A directory traversal vulnerability exists in...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2018-16201)

Adobe Experience Manager is an enterprise content management solution that helps you simplify the management and delivery of your content and assets. A cross-site scripting vulnerability exists in Adobe AEM versions 6.1 and 6.2, which originates from the program not adequately validating...