CVE-2018-2489

Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version...

Information disclosure

It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and calling device specific JavaScript APIs in the application. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues a...

Gitea < 1.5.3 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if...

GHSA-HC9W-4P87-J549 Prototype Pollution in cached-path-relative

Version of cached-path-relative before 1.0.2 are vulnerable to prototype pollution. Recommendation Update to version 1.0.2 or later...

KLA11340 Multiple vulnerabilities in Oracle Java SE

Multiple serious vulnerabilities were found in Oracle Java SE. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities: 1. An unspecified...

KLA11336 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Multiple use-after-free vulnerabilities can be exploited...

KLA11325 Multiple vulnerabilities in Mozilla Firefox and Mozilla Firefox ESR

Multiple serious vulnerabilities were found in Mozilla Firefox and Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A vulnerability in register allocation in JavaScript c...

PT-2018-1582 · Microsoft · Net Core +2

Name of the Vulnerable Software and Affected Versions: .NET Core versions 2.1 ASP.NET Core versions 2.1 System.IO.Pipelines affected versions not specified Description: A denial of service issue exists due to improper handling of requests by System.IO.Pipelines. This can be exploited by a remote...

Foreman < 1.14.0 Information Disclosure Vulnerability

Foreman is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:theforeman:foreman";...

LimeSurvey <= 3.14.7 Multiple Vulnerabilities

LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

K7 Anti-Virus Premium Multiple Vulnerabilities (Nov 2017)

K7 Anti-Virus Premium is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2018-3636 · Exiv2 +8 · Exiv2 +8

Name of the Vulnerable Software and Affected Versions: Exiv2 versions 0.26 and earlier Description: The issue is related to the incorrect handling of PNG files by the PngChunk::readRawProfile function in the Exiv2 library for managing media file metadata. This can be exploited by a remote attacke...

Joomla < 3.8.12 ACL Violation Vulnerability

Joomla is prone to an ACL violation vulnerability in custom fields. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

phpMyAdmin <= 4.8.2 XSS Vulnerability (PMASA-2018-5) - Linux

phpMyAdmin is prone to an authenticated cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ASUSTOR ADM < 3.1.6 Multiple Vulnerabilities

ASUSTOR ADM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if description...

HPESBHF03875 rev.1 - HPE Integrated Lights Out 4 and 5, (iLO 4, 5), Remote Denial of Service

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 4 iLO 4 - Prior to 2.60 HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers - Prior to 1.30 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- ...

KLA11307 Multiple vulnerabilities in Adobe Flash player

Multiple serious vulnerabilities were found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities in Adobe Flash Player can b...

GHSA-52R9-G5G6-2HJP Path Traversal in node-srv

Versions of node-srv before 2.1.1 are vulnerable to path traversal allowing a remote attacker to read files from the server that uses node-srv. Recommendation Update to version 2.1.1 or later...

PT-2018-17712 · Mcafee · Mcafee Data Loss Prevention (Dlp) For Windows

Name of the Vulnerable Software and Affected Versions: McAfee Data Loss Prevention DLP for Windows versions prior to 10.0.505 McAfee Data Loss Prevention DLP for Windows versions prior to 11.0.405 Description: The issue allows local users to bypass DLP policy via editing of local policy files whe...

GHSA-MM62-WXC8-CF7M Code Execution Through IIFE in serialize-to-js

Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression IIFE. Proof of Concept js var payload = "e: function eval'console.logexploited' " var serialize = require'serialize-to-js'; serialize.deserializepayload;...