Jumio SDK for Android Arbitrary Code Execution Vulnerability

Jumio SDK for Android is a software development kit for building authentication applications using biometrics based on the Android platform. A security vulnerability exists in versions of Jumio SDK for Android prior to 1.5.0. The vulnerability can be exploited to execute arbitrary code via the...

Enhancesoft osTicket Arbitrary Password Reset Vulnerability

Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A security vulnerability exists in Enhancesoft osTicket versions prior to 1.10.2. A remote attacker can exploit the vulnerability to reset arbitrary passwords...

Enhancesoft osTicket cross-site scripting vulnerability (CNVD-2018-07903)

Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A cross-site scripting vulnerability exists in the /scp/index.php file in Enhancesoft osTicket versions prior to 1.10.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'sor...

rap2hpoutre Laravel Log Viewer Security Bypass Vulnerability

rap2hpoutre Laravel Log Viewer is a log viewer for the Laravel development framework. A security vulnerability exists in rap2hpoutre Laravel Log Viewer prior to version 0.13.0. A remote attacker can exploit this vulnerability to bypass access restrictions...

Kontena server/app/views/static/code.html page cross-site scripting vulnerability

Kontena is a suite of open source microservices platforms capable of running applications as containers. The 'kontena master login --remote' code on the server/app/views/static/code.html page in Kontena versions prior to 1.5.0 indicates a cross-site scripting vulnerability. A remote attacker coul...

Unspecified Vulnerability in inversoft prime-jwt

inversoft prime-jwt is an open source Java 8-based JWT library . A security vulnerability exists in JWTDecoder.decode in versions prior to inversoft prime-jwt 1.3.0 and commit 0d94dcef0133d699f21d217e922564adbb83a227. No details of the vulnerability are provided at this time...

PYSEC-2018-8

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

AZL-7346 CVE-2018-1057 affecting package samba for versions less than 4.12.5-6

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts eg Domain Controllers...

Atlassian Floodlight Controller LoadBalancer Module Denial of Service Vulnerability

Atlassian Floodlight Controller is a Floodlight Controller product from Atlassian Australia.LoadBalancer module is one of the load balancing modules. A contention condition vulnerability exists in the LoadBalancer module in Atlassian Floodlight Controller versions prior to 1.2. A remote attacker...

CVE-2017-7434

In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles...

Synology Surveillance Station File and Directory Information Disclosure Vulnerability

Synology Surveillance Station is a video management application from Synology, and User Profile is one of the user information storage files. An information disclosure vulnerability exists in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station versions prior to...

DEBIAN-CVE-2018-7490

uWSGI before 2.0.17 mishandles a DOCUMENTROOT check during use of the --php-docroot option, allowing directory traversal...

CVE-2018-7280

The Ninja Forms plugin before 3.2.14 for WordPress has XSS...

Vobot Clock Information Disclosure Vulnerability

The Vobot Clock is a smart bedside alarm clock equipped with Amazon Alexa, Sleep Coach and Daily Routine programs. An information disclosure vulnerability exists in VOBOT CLOCK versions prior to 0.99.30. The vulnerability arises because the Vobot firmware does not validate the certificate of the...

CVE-2018-0116

A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber without providing a valid password; however, the attacker must provide a valid username. The vulnerability is due to incorrect RADIUS user...

UBUNTU-CVE-2017-15391

Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation via a crafted HTML page...

Atlassian Confluence Server Cross-Site Scripting Vulnerability (CNVD-2018-03443)

Atlassian Confluence Server is a suite of professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build an enterprise WiKi. the software enables collaboration and knowledge sharing amongst team members. A cross-site scripting...

AZL-43897 CVE-2012-6708 affecting package python-httplib2 0.20.3-3

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

CVE-2018-2699

Vulnerability in the Application Express component of Oracle Database Server. The supported version that is affected is Prior to 5.1.4.00.08. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Express. Successful attacks require...

LiveZilla knowledgebase.php file cross-site scripting vulnerability

LiveZilla is a free online customer service system from the German company LiveZilla. The system provides real-time monitoring of visitors, offline messages, GeoTracking map tracking, access statistics, online chat and other features. A cross-site scripting vulnerability exists in the...