rubygems: Improper verification of signatures in tarball allows to install mis-signed gem

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in...

rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can...

rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to...

CVE-2018-1749

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 148484...

SemCms website builder 2.7 version exists arbitrary file deletion vulnerability

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox , google, 360 and other mainstream browsers.SemCms php version written in php language, combined with apache, in window, or linux system to run...

SemCms foreign trade website management system suffers from overstepping access vulnerability

SemCms is an open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers. Semcms foreign trade website management system V2.7 version of the existence of ultra-rights access vulnerability , du...

SQL Injection Vulnerability in PHP Multilingual Version V2.7 of SEMCMS Foreign Trade Web Site

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers.SemCms using php and vb language writing, combined with apache or iis running. SEMCMS foreign trade website PHP...

CVE-2018-2833

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Enterprise Management Console. Supported versions that are affected are 2.7, 2.8, 2.9 and 2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

Juniper AppFormix Elevation of Privilege Vulnerability

Juniper AppFormix is a Juniper Networks optimization and management software platform for public, private and hybrid clouds. A security vulnerability exists in Juniper AppFormix version 2.7, version 2.11 prior to 2.11.3, and version 2.15 prior to 2.15.2. An attacker could exploit the vulnerabilit...

snapd security bypass vulnerability

snapd is a tool used in Linux to create application snapshots. A security vulnerability exists in snapd versions 2.27 through 2.29.2, which stems from a program that creates the snap logs command to invoke journalctl without matching the parameters.An attacker could use this vulnerability to bypa...

MalwareFox AntiMalware Local Elevation of Privilege Vulnerability (CNVD-2018-04848)

MalwareFox AntiMalware is a suite of malware removal tools from the American company MalwareFox. The tool automatically detects and removes malware, cleans browsers, repairs files corrupted by rootkits and protects against virus infections in real time. A local elevation of privilege vulnerabilit...

CVE-2018-2636

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Security. Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2018-2608

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Security. The supported version that is affected is 2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality...

IBM Tivoli Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2018-01130)

IBM Tivoli Key Lifecycle Manager enables you to locally create, distribute, back up, archive and manage the lifecycle of keys and certificates in your organization. An information disclosure vulnerability exists in IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7. The vulnerability arises becau...

IBM Tivoli Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2018-01129)

IBM Tivoli Key Lifecycle Manager enables you to locally create, distribute, back up, archive and manage the lifecycle of keys and certificates in your organization. An information disclosure vulnerability exists in IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7. The vulnerability arises becau...

CVE-2017-1672

IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 133639...

SimpleXML XML External Entity Injection Vulnerability

SimpleXML is a Java-based high-performance XML serialization and configuration framework. An XML external entity injection vulnerability exists in SimpleXML version 2.7.1. An attacker can exploit this vulnerability to implement a server-side request forgery attack to obtain sensitive information ...

Oracle Java SE Java Advanced Management Console Sever Subcomponent Denial of Service Vulnerability

Oracle Java SE is Oracle's suite of standard edition Java platforms for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments. java Advanced Management Console is one of the Java Advanced Management Console components for creating...

CVE-2017-9939

A vulnerability was discovered in Siemens SiPass integrated All versions before V2.70 that could allow an attacker with network access to the SiPass integrated server to bypass the authentication mechanism and perform administrative operations...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23893)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the /apps/appcomment/controller/insert.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the help of the 'name'...