UBUNTU-CVE-2018-19877

login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field...

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

mysql: Server: Connection unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQ...

Lenovo Chassis Management Module (CMM) Information Disclosure Vulnerability

The Lenovo Chassis Management Module CMM is a hot-swappable Lenovo Flex System module that can be used to configure and manage all installed Lenovo Flex System components. An information disclosure vulnerability exists in Lenovo CMM versions prior to 2.0.0, which stems from the program's use of a...

CVE-2018-6067

Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

UBUNTU-CVE-2018-6077

Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-17913

A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an attacker to execute code in the context of the application...

GoPro gpmf-parser denial of service vulnerability

GoPro gpmf-parser is a telemetry data parser in GPMF format for use in GoPro cameras. A security vulnerability exists in the 'GPMFScaledData' function of the GPMFparser.c file in GoPro gpmf-parser versions prior to 1.2.1. An attacker can exploit this vulnerability to cause a denial of service...

Google Chrome V8 Remote Code Execution Vulnerability

Google Chrome is the United States Google Google company developed a Web browser. v8 is one of the open source JavaScript engine. A security vulnerability exists in V8 in versions of Google Chrome prior to 70.0.3538.67. A remote attacker can exploit the vulnerability to execute code...

Google Chrome Omnibox URL Spoofing Vulnerability (CNVD-2018-24371)

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 70.0.3538.67, which stems from the program failing to properly and quickly clear some rendered content. A remote...

GHSA-WHW7-H25V-9QVX Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4...

PT-2018-2144 · Mysql Server +1 · Mysql Connectors +1

Name of the Vulnerable Software and Affected Versions: MySQL Connectors versions 8.0.12 and prior Description: The issue is related to insufficient access control in the Connector/J subcomponent of the MySQL Connectors system. It allows a remote attacker to gain unauthorized access to protected...

CVE-2018-17900

Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentials which could allow an attacker to obtain credentials for remote access to controllers...

CVE-2018-12471

A External Entity Reference 'XXE' vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37...

CVE-2018-6689

Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint DLPe 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attackers to bypass local security protection via specific conditions...

CVE-2018-10605

Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over the RTU using default credentials to connect to the RTU...

Inedo ProGet Cross-Site Scripting Vulnerability

Inedo ProGet is a general-purpose package manager from Inedo USA with package management, filtering and upgrading features. A cross-site scripting vulnerability exists in Inedo ProGet versions prior to 5.0 Beta5. A remote attacker can exploit the vulnerability to change advanced settings...

UBUNTU-CVE-2018-4358

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...

CVE-2018-8850

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software does not validate input properly, allowing an attacker to craft the input in a form that is not expected by the rest of the application. This would lead to parts of the unit receiving unintended input, which may result ...