PT-2018-13212

Name of the Vulnerable Software and Affected Versions Cloud Foundry Bits Service versions prior to 2.14.0 Description The issue concerns the use of an insecure hashing algorithm to sign URLs, which could allow a remote malicious user to obtain a signed URL, extract the signing key, and gain...

CVE-2018-15444: Improper Restriction of XML External Entity Reference

A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entri...

CVE-2018-11062: Use of Hard-coded Credentials

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default...

PT-2018-2908

Name of the Vulnerable Software and Affected Versions Secret Net Studio affected versions not specified Description The issue is related to insufficient input control in the SnCloneVault.sys driver of the Secret Net Studio information protection system. Exploitation of this issue may allow an...

CVE-2018-1000197: Incorrect Authorization

An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration...

PT-2018-6802

Name of the Vulnerable Software and Affected Versions: burp versions prior to 2.1.32 Description: The issue is related to incorrect group ownership of the /etc/burp directory, potentially allowing local users to gain read and write access to arbitrary files by modifying the burp-server.conf file...

CVE-2018-4990 Adobe Reader code execution exploit analysis-exploit warning-the black bar safety net

2018 5 on 15 September, ESET released the article“A tale of two zero-days”, the article disclosed this year 3 month ESET in malware scan engine VirusTotal on the capture of the one used to attack the test PDF document. The PDF document contains a sample of two pieces of 0-day Vulnerability,...

Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration

Black Duck Hub Plugin did not perform permission checks for its /descriptorByName/com.blackducksoftware.integration.hub.jenkins.PostBuildHubScan/config.xml API endpoint. This allowed any user with Overall/Read permission to both read and write the plugin configuration XML. Black Duck Hub Plugin...

CVE-2018-2792

Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite subcomponent: Ipmitool. The supported version that is affected is Prior to 2.4.3. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

PT-2018-4998

Name of the Vulnerable Software and Affected Versions Phoenix Contact ILC PLCs affected versions not specified Description The issue concerns the web server in Phoenix Contact ILC PLCs, which allows unauthorized access to read and write PLC variables due to a lack of authentication. Recommendatio...

CVE-2016-8380: Access to Critical Private Variable via Public Method

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication...

PT-2018-10054

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Enterprise version 3.7 Description The issue allows an attacker to override access control for container network filesystems, specifically for GlusterFS and NFS. This could enable the attacker to read and write any data on th...

CVE-2018-0100

A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity XXE entries when...

CVE-2018-0100

The CVE-2018-0100 issue affects the Cisco AnyConnect Secure Mobility Client Profile Editor. It is an XML External Entity (XXE) injection vulnerability in how the Profile Editor parses XML files, allowing an unauthenticated, local attacker to read and write information on the affected system. Mult...

CVE-2018-0100: Improper Restriction of XML External Entity Reference

A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity XXE entries when...

Cisco AnyConnect Profile Editor XML External Entity Injection Vulnerability

A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity XXE entries when...

CVE-2017-10315

Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM subcomponent: UIF Open UI. Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful...

CVE-2017-12154

The preparevmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write...

PT-2017-12406

Name of the Vulnerable Software and Affected Versions Cisco SocialMiner affected versions not specified Description A vulnerability in the web-based user interface could allow an unauthenticated, remote attacker to have read and write access to information stored in the system. The issue is due t...

CVE-2017-6662: Improper Input Validation

A vulnerability in the web-based user interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker mu...