CVE-2018-19358

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

CVE-2018-19358

CVE-2018-19358 affects GNOME Keyring up to version 3.28.2, enabling local attackers to retrieve login credentials via Secret Service API calls and the D‑Bus interface when the keyring is unlocked. Root cause cited: failure to apply D‑Bus protection mechanisms (busconfig/policy XML); vendor disput...

CVE-2018-19358

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

CVE-2018-19358: Undefined Security Weakness

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

PT-2018-14941 · Gnome +2 · Gnome Keyring +2

Name of the Vulnerable Software and Affected Versions: GNOME Keyring versions prior to 3.28.2 Description: The issue allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked. This occurs because available D-Bus protection...

CVE-2018-14058: Improper Neutralization of Special Elements used in an SQL Command

Pimcore before 5.3.0 allows SQL Injection via the REST web service API...

Security Bulletin: IBM PowerVC is impacted by OpenStack Glance server-side request forgery (CVE-2017-7200)

Summary IBM PowerVC may disclose some sensitive information while creating images with 'copyfrom' feature in the v1 Image Service API. Vulnerability Details CVEID: CVE-2017-7200 DESCRIPTION: OpenStack Glance is vulnerable to server-side request forgery, caused by a flaw in the 'copyfrom' feature ...

CVE-2013-3703: Missing Authorization

The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...

Double free

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, incorrect error handling could lead to a double fre...

PT-2018-4499

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level Description The issue is related to incorrect error handling that could lead to a double free in the QTEE file service API. This affects Android on various Qualcomm Snapdragon Mobile an...

CVE-2015-9165: Double Free

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, incorrect error handling could lead to a double fre...

CVE-2017-10037

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

Code injection

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

CVE-2017-10037

CVE-2017-10037 is a vulnerability in Oracle Fusion Middleware’s Oracle BI Publisher (Web Service API subcomponent). Affected are BI Publisher versions 11.1.1.7.0 and 11.1.1.9.0. An unauthenticated attacker with network access via HTTP can compromise BI Publisher, potentially enabling unauthorized...

CVE-2017-10037: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

Unspecified Vulnerability in Oracle BI Publisher (CNVD-2017-31688)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's business innovation platform for enterprise and cloud environments, which provides middleware, software collections, etc. Oracle BI Publisher formerly known as XML Publisher is one of the reporting component. An unspecified...

CVE-2017-7200

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

CVE-2017-7200

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

CVE-2017-7200

The copyfrom feature in Image Service API v1 allows an attacker to perform masked network port scans. It is possible to create images with a URL such as 'http://localhost:22'. This could allow an attacker to enumerate internal network details while appearing masked, because the scan appears to...

CVE-2017-7200: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...