Pivotal Container Service Information Disclosure Vulnerability

Pivotal Container Service is a Kubernetes-based container service from US-based Pivotal Software. An information disclosure vulnerability exists in Pivotal Container Service versions prior to 1.2.0. An attacker could exploit this vulnerability to obtain IaaS credentials and execute an operation...

CVE-2018-8848

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor...

CVE-2018-17128

A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode...

NVIDIA GeForce Experience Information Disclosure Vulnerability

NVIDIA GeForce Experience is a suite of automatic graphics card update tools from NVIDIA. An information disclosure vulnerability exists in NVIDIA GeForce Experience versions prior to 3.14.1, which can be exploited by attackers to conduct man-in-the-middle attacks and obtain sensitive information...

DEBIAN-CVE-2017-2618

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty null write to this file can crash the system by causing the system to attempt to access unmapped kernel memory...

Cisco SD-WAN Solution Local Command Injection Vulnerability

Cisco vBond Orchestrator Software are products of Cisco. vBond Orchestrator Software is a set of security network extension management software. vEdge 100 Series Routers is a 100 series router product. SD-WAN Solution is a set of network extension solution running in it. A command injection...

CVE-2018-3089

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

Command injection

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway SMG allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve...

CVE-2018-1000531

inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header usi...

CVE-2018-0602

Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0603

Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-5382

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox 51...

Synology DiskStation Manager Command Injection Vulnerability (CNVD-2018-11370)

Synology DiskStation Manager DSM is a set of operating systems for use on networked storage servers NAS from Synology Inc. The operating system can manage information such as data, files, photos, music, etc. EZ-Internet is one of the network configuration tools. A command injection vulnerability...

PT-2018-5338 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2-23739 Description: A command injection issue exists, allowing remote authenticated users to execute arbitrary commands via the username parameter. Recommendations: For versions prior to...

Quest DR Series Disk Backup Software Elevation of Privilege Vulnerability (CNVD-2018-15909)

The Quest DR Series are disk storage and deduplication appliances. An elevation of privilege vulnerability exists in versions of Quest DR Series disk backup software prior to 4.0.3.1. An attacker can exploit this vulnerability via env to elevate privileges from web server user to root...

CVE-2018-1002100

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...

CVE-2018-8843

Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software files that may cause the software application to crash, potentially losing any unsaved data...

Brave Browser Denial of Service Vulnerability (CNVD-2018-08687 )

Brave Browser is a web browser from Brave Software, USA. A security vulnerability exists in Brave Browser versions prior to 0.13.0, which arises from the program's failure to properly handle window dialogs. A remote attacker can exploit this vulnerability to cause a denial of service resource...

Foreman SQL Injection Vulnerability

Foreman is a complete lifecycle management tool for physical and virtual servers. A SQL injection vulnerability exists in Foreman versions prior to 1.16.1. The vulnerability arises due to an input validation flaw in the id field in Foreman's dashboard controller. An attacker can exploit the...

Unspecified Vulnerability in KDE Plasma Workspace

KDE Plasma Workspace is an umbrella term for all graphical environments developed by the KDE community and is part of KDE Software Compilation 4, the latest series of desktop environments. A security vulnerability exists in the dataengines/notifications/notificationsengine.cpp file in KDE Plasma...