PT-2020-6122 · Google +8 · Libwebp +8

Name of the Vulnerable Software and Affected Versions: libwebp versions prior to 1.0.1 Description: A flaw was found in libwebp due to a use-after-free caused by a thread being killed too early. The highest threat from this issue is to data confidentiality and integrity as well as system...

uriparser UriCommon.c File Denial of Service Vulnerability

uriparser is a standard based on RFC 3986 URI parsing and processing library . A security vulnerability exists in the UriCommon.c file in uriparser versions prior to 0.9.0. An attacker can exploit this vulnerability to cause a denial of service with the 'uriResetUri' function...

PT-2018-12643 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions prior to 4.1.5 Description: The issue is related to a buffer overflow in the 'features/index' translator, specifically in the code handling the GF XATTR CLRLK CMD xattr within the pl getxattr function. This could ...

ACME mini_httpd Arbitrary File Read Vulnerability

ACME minihttpd is a small HTTP server from ACME Labs. A security vulnerability exists in ACME minihttpd versions prior to 1.30. A remote attacker can exploit this vulnerability to read arbitrary files...

Atlassian Confluence MESILAT Zabbix Plugin Arbitrary File Read Vulnerability

Atlassian Confluence is a suite of professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build enterprise WiKi.The software enables collaboration and knowledge sharing among team members.MESILAT Zabbix Plugin is one of the Zabb...

Pivotal Container Service Information Disclosure Vulnerability

Pivotal Container Service is a Kubernetes-based container service from US-based Pivotal Software. An information disclosure vulnerability exists in Pivotal Container Service versions prior to 1.2.0. An attacker could exploit this vulnerability to obtain IaaS credentials and execute an operation...

CVE-2018-8848

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor...

CVE-2018-17128

A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode...

NVIDIA GeForce Experience Information Disclosure Vulnerability

NVIDIA GeForce Experience is a suite of automatic graphics card update tools from NVIDIA. An information disclosure vulnerability exists in NVIDIA GeForce Experience versions prior to 3.14.1, which can be exploited by attackers to conduct man-in-the-middle attacks and obtain sensitive information...

DEBIAN-CVE-2017-2618

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty null write to this file can crash the system by causing the system to attempt to access unmapped kernel memory...

Cisco SD-WAN Solution Local Command Injection Vulnerability

Cisco vBond Orchestrator Software are products of Cisco. vBond Orchestrator Software is a set of security network extension management software. vEdge 100 Series Routers is a 100 series router product. SD-WAN Solution is a set of network extension solution running in it. A command injection...

CVE-2018-3089

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

Command injection

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway SMG allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve...

CVE-2018-1000531

inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header usi...

CVE-2018-0603

Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0602

Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-5382

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox 51...

Synology DiskStation Manager Command Injection Vulnerability (CNVD-2018-11370)

Synology DiskStation Manager DSM is a set of operating systems for use on networked storage servers NAS from Synology Inc. The operating system can manage information such as data, files, photos, music, etc. EZ-Internet is one of the network configuration tools. A command injection vulnerability...

PT-2018-5338 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2-23739 Description: A command injection issue exists, allowing remote authenticated users to execute arbitrary commands via the username parameter. Recommendations: For versions prior to...

Quest DR Series Disk Backup Software Elevation of Privilege Vulnerability (CNVD-2018-15909)

The Quest DR Series are disk storage and deduplication appliances. An elevation of privilege vulnerability exists in versions of Quest DR Series disk backup software prior to 4.0.3.1. An attacker can exploit this vulnerability via env to elevate privileges from web server user to root...