Bitcoin Core Software Patches a Critical DDoS Attack Vulnerability

The Bitcoin Core development team has released an important update to patch a major DDoS vulnerability in its underlying software that could have been fatal to the Bitcoin Network, which is usually known as the most hack-proof and secure blockchain. The DDoS vulnerability, identified as...

MGASA-2018-0388 Updated libextratcor packages fix security vulnerability

Several vulnerabilities were discovered in libextractor which may lead to denial of service or the execution of arbitrary code if a specially crafted file is opened CVE-2018-14346, CVE-2018-14347, CVE-2018-16430...

MGASA-2018-0382 Updated webkit2 packages fix security vulnerability

The webkit2 package has been updated to version 2.20.5, fixing several security issues and other bugs...

PT-2018-12689 · Webpack · Webpack-Dev-Server

Name of the Vulnerable Software and Affected Versions: webpack-dev-server versions prior to 3.1.10 webpack-dev-server versions prior to 3.1.6 Description: An issue in the WebSocket server used for Hot Module Replacement HMR allows attackers to steal a developer's source code because the origin of...

DSA-4297-1 chromium-browser - security update

Bulletin has no description...

GHSA-FM87-46VV-JQRR Path Traversal in html-pages

Versions of html-pages before 2.1.0 are vulnerable to path traversal. Recommendation Update to version 2.1.0 or later...

MGASA-2018-0372 Updated flash-player-plugin packages fix security vulnerability

Updated flash-player-plugin packages fix security vulnerability: Successful exploitation of the currently un-disclosed vulerability could lead to information disclosure CVE-2018-15967...

Microsoft Office SharePoint CVE-2018-8426 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

HPESBHF03893 rev.1 - HPE Intelligent Management Center (iMC) Wireless Services Manager Software, Remote Code Execution

Potential Security Impact: Remote: Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE IMC Wireless Services Manager Software - Prior to IMC WSM 7.3 E0506P02 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2018-7103 |...

Multiple vulnerabilities in INplc

Overview INplc provided by MICRONET CORPORATION contains multiple vulnerabilities listed below. DLL preloading vulnerability CWE-427 - CVE-CVE-2018-0667 Buffer overflow CWE-119 - CVE-2018-0668 Authentication bypass CWE-287 - CVE-2018-0669 Authentication bypass CWE-287 - CVE-2018-0670 Privilege...

JVN#59624986: Multiple vulnerabilities in INplc

INplc provided by MICRONET CORPORATION contains multiple vulnerabilities listed below. DLL preloading vulnerability CWE-427 - CVE-CVE-2018-0667 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H| Base Score: 7.8 CVSS v2| AV:N/AC:M/AU:N/C:P/I:P/A:P| Base Score...

The vulnerability of the config_transfer.cgi and software_update.cgi components of FL SWITCH software for controlling switches allows a hacker to execute arbitrary commands.

The vulnerability of the configtransfer.cgi and softwareupdate.cgi components of the FL SWITCH software for controlling switches from Phoenix Contact is related to the absence of a mechanism to neutralize special elements in the input commands of the operating system. Exploiting this vulnerabilit...

CVE-2018-1000670

KOHA Library System version 16.11.x up until 16.11.13 and 17.05.x up until 17.05.05 contains a Cross Site Scripting XSS vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?op=enter , /cgi-bin/koha/circ/circulation.pl?borrowernumber=number ,...

Cisco Umbrella API Unauthorized Access Vulnerability

A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizations. The vulnerability is due to insufficient authentication configurations for the API interface of Cisco Umbrella. An attacker could...

Cisco SD-WAN Solution Privilege Escalation Vulnerability

A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the error reporting applicatio...

Cisco SD-WAN Solution Command Injection Vulnerability

A vulnerability in the command-line interface CLI in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability ...

AirWatch Agent and VMware Content Locker updates resolve data protection vulnerabilities

a. The AirWatch Agent for iOS devices contains a data protection vulnerability The AirWatch Agent for iOS devices contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted. VMware would like to thank Stephan Sekula of Compass Security for...

JVN#02037158: AttacheCase vulnerable to arbitrary script execution

AttacheCase is an open source file encryption software provided by HiBARA Software. If a setting file AtcCase.ini is specially crafted and it resides in the same folder where ATC file resides, it is leveraged to execute an arbitrary script when ATC file is decrypted. Impact A remote unauthenticat...

WordPress Ninja Forms plugin <= 3.3.13 - CSV Injection vulnerability

CSV Injection vulnerability fund by Mostafa Gharzi in WordPress Ninja Forms plugin versions = 3.3.13. Solution Update the WordPress Ninja Forms plugin to the latest available version at least 3.3.14...

Experts Urge Rapid Patching of ‘Struts’ Bug

In September 2017, Equifax disclosed that a failure to patch one of its Internet servers against a pervasive software flaw -- in a Web component known as Apache Struts -- led to a breach that exposed personal data on 147 million Americans. Now security experts are warning that blueprints showing...