CVE-2018-0280

A vulnerability in the Real-Time Transport Protocol RTP bitstream processing of the Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient input validation of incoming RTP bitstreams. An attacker...

TinyXML2 'XMLDocument::Parse' function heap buffer overflow vulnerability

TinyXML2 is a C++-based open source XML parser . A heap buffer overflow vulnerability exists in the 'XMLDocument::Parse' function of the libtinyxml2.so file in TinyXML2 version 6.2.0. An attacker can exploit this vulnerability to cause a buffer out-of-bounds read...

DEBIAN-CVE-2018-10773

NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service application crash, as demonstrated by copac2xml...

DEBIAN-CVE-2018-10775

NULL pointer dereference in the fieldsadd function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service application crash, as demonstrated by end2xml...

bibutils null pointer dereference vulnerability (CNVD-2018-09313)

bibutils is a document format conversion tool. A security vulnerability exists in the 'addsn' function in the fields.c file of the libbibcore.a file in bibutils 6.2 and earlier. A remote attacker can exploit this vulnerability to cause a denial of service null pointer backreference and applicatio...

PT-2018-10108 · Cksource +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: Liferay versions 6.2.x and earlier Description: The issue concerns an FCKeditor configuration that may allow an attacker to upload or transfer files of potentially dangerous types. These files can be automatically processed within the product...

CVE-2018-2836

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBo...

UBUNTU-CVE-2018-2844

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBo...

CVE-2018-2849

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 16.2 and 17.1 - 17.12. Easily exploitable vulnerability allows low privileged attacker with network...

Open-AudIT CSV Injection Vulnerability

Open-AudIT is a network discovery and auditing program. The program intelligently scans networks and network devices and provides status reports. A security vulnerability exists in the export function in versions prior to Open-AudIT 2.2. An attacker can exploit the vulnerability to inject Windows...

CVE-2018-10138

The CATALooK.netStore module through 7.2.8 for DNN formerly DotNetNuke allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter...

SAP Business One Cross-Site Scripting Vulnerability

SAP Business One is a business management software for small businesses. The software includes features such as financial management, customer relationship management and human resource management. A cross-site scripting vulnerability exists in SAP Business One versions 9.2 and 9.3, which arises...

Apple iOS, Safari and tvOS JavaScriptCore Cross-Site Scripting Vulnerability

Apple iOS, Safari, and tvOS are all products of Apple Inc. Apple Safari is a web browser that is the default browser that comes with the Mac OS X and iOS operating systems; iOS is a set of operating systems developed for mobile devices; and tvOS is a set of operating systems for smart TVs...

iScripts EasyCreate cross-site scripting vulnerability (CNVD-2018-08315)

IScripts EasyCreate is a set of online website builder from Iscripts, Inc. The tool can be used on the server for the client to provide website building services , belong to the fully customizable . A cross-site scripting vulnerability exists in the Site title field in IScripts EasyCreate version...

Wireshark epan/dissectors/packet-isup.c file memory leak vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in the epan/dissectors/packet-isup.c file in Wireshark...

Wireshark ui/failure_message.c file memory leak vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in the ui/failuremessage.c file in Wireshark versions...

Libav 'av_audio_fifo_size' function null pointer reference vulnerability

Libav formerly FFmpeg is Libav team's set of cross-platform audio and video can be recorded, converted to a solution, which includes a libavcodec encoder. A security vulnerability exists in the 'avaudiofifosize' function in the libavutil/audiofifo.c file in Libav version 12.2. A remote attacker c...

Jenkins Mercurial Plugin Security Bypass Vulnerability

Jenkins is an open source software project , is based on Java development of a continuous integration tool . A security vulnerability exists in the MercurialStatus.java file in Jenkins Mercurial Plugin 2.2 and earlier versions. An attacker can exploit the vulnerability to obtain a list of nodes a...

CVE-2018-8965

An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8969

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...