4353 matches found
PT-2018-1519 · Containous · Traefik
Name of the Vulnerable Software and Affected Versions: Containous Traefik versions 1.6.x through 1.6.5 Description: The issue is related to errors in the implementation of the API in the Containous Traefik reverse proxy server. If the --api option is used and authentication is missing, the...
PT-2018-3889 · D Link · D-Link Dir-601
Name of the Vulnerable Software and Affected Versions: D-Link DIR-601 version 2.02NA Description: An issue allows an attacker with low privilege "User" account access to intercept the response from a POST request and obtain "Admin" rights due to the admin password being displayed in XML. The...
PT-2018-6273 · Insteon · Insteon Hub
Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: An attacker could send an authenticated HTTP request to trigger this issue in Insteon Hub. The value for the s url key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large, an...
PT-2018-10495 · Intuit · Intuit Lacerte
Name of the Vulnerable Software and Affected Versions: Intuit Lacerte version 2017 Intuit Lacerte versions prior to 2017 Description: The software transfers the entire customer list in cleartext over SMB, allowing attackers to obtain sensitive information by sniffing the network or conduct...
PT-2018-12614 · Thomson Reuters · Thomson Reuters Ultratax Cs
Name of the Vulnerable Software and Affected Versions: Thomson Reuters UltraTax CS version 2017 Description: The software has a password protection option, but the level of protection may not meet some customers' expectations because the data is stored in cleartext. Customer data is stored in...
PT-2018-3181 · Mutt +7 · Mutt +7
Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.10.1 NeoMutt versions prior to 2018-07-16 Description: The issue is related to errors in handling references to the ".." directory in mailbox names in the imap/util.c component of Mutt and NeoMutt email clients. This...
PT-2018-10145
Name of the Vulnerable Software and Affected Versions git-annex affected versions not specified Description The issue concerns a private data exposure and exfiltration attack in git-annex. It could expose the content of files located outside the git-annex repository or content from a private web...
PT-2018-11608 · Aqua Security +2 · Tcpreplay +2
Name of the Vulnerable Software and Affected Versions: Tcpreplay version 4.3.0 beta1 Description: The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via crafted packets. This can be demonstrated using tcpprep...
PT-2018-3897 · Oracle +1 · Mysql Server
Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 8.0.11 and prior Description: The issue is related to inadequate access control in the Server: Replication component of Oracle MySQL Server. This can be exploited by a remote attacker to cause a denial of service...
PT-2018-16141 · Node.Js · Connect
Name of the Vulnerable Software and Affected Versions: connect node module versions prior to 2.14.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability due to a lack of validation of a file in the directory.js middleware. This allows for potential exploitation. No...
PT-2018-5368 · Moxa · Moxa Edr-810
Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 version 4.1 build 17030317 Description: A password storage issue exists in the operating system functionality, allowing an attacker with shell access to extract passwords in clear text from the device. Recommendations: For Moxa...
PT-2018-1311 · Microsoft +3 · Ie +5
Name of the Vulnerable Software and Affected Versions: Microsoft Windows VBScript Engine versions prior to the fixed version Description: A remote code execution issue exists in the way the VBScript engine handles objects in memory. This allows remote attackers to execute arbitrary code and affec...
PT-2018-10049 · Z Blogphp · Z-Blogphp
Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.5.2 Description: The issue allows an administrator to inject a Cross Site Scripting XSS payload via the ZC BLOG NAME parameter in the "Web site settings -- Basic setting -- Website title" section, accessible through the zb...
CVE-2014-2552
Brookins Consulting BC Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote attackers to gain access to sensitive data...
PT-2018-9752 · Vaultize · Vaultize Enterprise File Sharing
Name of the Vulnerable Software and Affected Versions: Vaultize Enterprise File Sharing version 17.05.31 Description: An issue was discovered that allows for Stored XSS via the optional message field of a file request. Recommendations: For Vaultize Enterprise File Sharing version 17.05.31, consid...
PT-2018-5655 · Foxit · Foxit Pdf Reader
Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 8.3.2.25013 Description: A use-after-free issue in the JavaScript engine of Foxit PDF Reader can be exploited by opening a specially crafted PDF document, allowing arbitrary code execution. This can be triggered by an...
PT-2018-16240 · Nasa · Cfitsio
Name of the Vulnerable Software and Affected Versions: NASA CFITSIO version 3.42 Description: The issue arises from specially crafted images parsed via the library, which can cause a stack-based buffer overflow, overwriting arbitrary data. This can be triggered by delivering an FIT image,...
PT-2018-3913 · D Link · D-Link Dsl-3782
Name of the Vulnerable Software and Affected Versions: D-Link DSL-3782 versions 1.01 Description: The issue is related to a buffer overflow in the /userfs/bin/tcapi binary of the Diagnostics component in the D-Link DSL-3782 router's firmware. This can be exploited by passing a long buffer as the...
PT-2018-10222 · Coreos +3 · Etcd +3
Name of the Vulnerable Software and Affected Versions: etcd versions 3.3.1 and earlier Description: A cross-site request forgery flaw was found, allowing an attacker to set up a website that tries to send a POST request to the etcd server and modify a key. Since adding a key is done with PUT, it ...
