CVE-2018-3086

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

CVE-2018-3085

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

Nextcloud Server Information Disclosure Vulnerability (CNVD-2018-12756)

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Server is one of the server version. A security vulnerability exists in Nextcloud Server versions prior to 12.0.8 and 13.0.3, which stems from the program's...

Red Hat OpenShift Container Platform source-to-image component privilege access control vulnerability

The Red Hat OpenShift Container Platform is a Red Hat application platform that enables organizations to develop, deploy, and manage existing container-based applications across physical, virtual, and public cloud infrastructures. source-to-image component is a tool for building and injecting...

PT-2018-3871

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.4.3 Description The issue is related to an open redirect vulnerability, which allows an attacker to redirect users to an untrusted site via internal URLs. This can be exploited by a remote attacker to redirect users t...

DEBIAN-CVE-2018-11219

An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking...

Unspecified vulnerability in ikst

ikst is a software package. A security vulnerability exists in versions prior to ikst 1.1.2 that originates when the program downloads resources over the HTTP protocol. An attacker could use the vulnerability to modify or read downloaded resources and potentially execute code...

PT-2018-3862 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.17.4 Description: The issue is related to an integer overflow in the uvesafb setcmap function, which could allow local attackers to crash the kernel or potentially elevate privileges. This is because kmalloc...

CVE-2017-7838

Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punycode display instead of the primary domain being displayed in native script and the sub-domain only displaying as punycode. This could be used for limited...

CVE-2017-7768

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access,...

CVE-2016-9894

A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. This vulnerability affects Firefox 50.1...

PT-2018-18714 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2-23739 Description: The issue concerns an unverified password change vulnerability in the Change Password feature. This allows remote authenticated users to reset passwords without proper...

chromium-browser: Out of bounds memory access in V8

Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

PT-2018-16141 · Node.Js · Connect

Name of the Vulnerable Software and Affected Versions: connect node module versions prior to 2.14.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability due to a lack of validation of a file in the directory.js middleware. This allows for potential exploitation. No...

CVE-2016-10665

herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlle...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15886)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the global view addmember method in Quest DR Series disk backup software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute arbitrary commands...

PT-2018-18720 · Synology · Synology Drive

Name of the Vulnerable Software and Affected Versions: Synology Drive versions prior to 1.0.2-10275 Description: The issue is related to improper access control, allowing remote authenticated users to access non-shared files or folders. The exact vectors used for this unauthorized access are not...

baryton-saxophone code execution vulnerability

baryton-saxophone is a module for installing and launching Selenium Server for Mac, Linux and Windows. A security vulnerability exists in baryton-saxophone versions prior to 3.0.1, which originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit...

Google Android elevation of privilege vulnerability (CNVD-2018-11484)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA in the U.S. Qualcomm is one of the Qualcomm components used in Qualcomm devices. A security vulnerability exists in the Qualcomm component in versions of Android prior to 7.0. No...

solr: Directory traversal via Index Replication HTTP API

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path...