CVE-2018-11049: Uncontrolled Search Path Element

RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious co...

CVE-2018-8046

The getTip method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip method of Action Column...

CVE-2018-1000504

Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerabili...

CVE-2018-1000505

Tooltipy tooltips for WP version 5 contains a Cross ite Request Forgery CSRF vulnerability in Settings page that can result in could allow anybody to duplicate posts. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1...

ewgaddis.lab6 Directory Traversal Vulnerability

ewgaddis.lab6 is a file server. A directory traversal vulnerability exists in ewgaddis.lab6. An attacker can exploit this vulnerability by placing "... /" in a URL to access the file system...

Cross site request forgery (csrf)

PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via usersubmit.php?upd=2, with resultant XSS...

RHEL 7 : thunderbird (RHSA-2018:1725)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:1725 advisory. - Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 CVE-2018-5150 - Mozilla: Use-after-free with SVG animations and clip...

Mozilla: Integer overflow and out-of-bounds write in Skia

An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. This vulnerability affects Thunderbird 52.8,...

SAP NetWeaver Open Redirect Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An open redirection vulnerability exists in SAP NetWeaver. An attacker can exploit the vulnerability by executin...

via-camping.com XSS vulnerability

Open Bug Bounty ID: OBB-580746 Description| Value ---|--- Affected Website:| via-camping.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6219: Improper Certificate Validation

An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesdrop and tamper with certain types of update data...

Elevation of Privilege Vulnerability in Multiple EMC Products

EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA Identity Management and Governance are products of EMC Corporation.EMC RSA Identity Governance and Lifecycle is a suite of lifecycle management solutions; EMC RSA Identity Management and Governance IMG is a suite ...

Ping Identity: Server-Side Request Forgery on SAML Application - Import via URL

Summary == The My Applications feature on PingOne Identity admin allows you to add new SAML applications to your account. One feature allows you to import metadata via URI instead of via upload. This uses Java 1.8 to make an external web request to the URI supplied. Typically this is hard to...

Bleach Design Vulnerability

Bleach is an HTML cleanup library for removing tags and attributes. A security vulnerability exists in version 2.1.x prior to Bleach 2.1.3 that stems from the program failing to properly filter attributes with URI values. An attacker could exploit this vulnerability to obtain sensitive informatio...

Design/Logic Flaw

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels hardware appliance and software bundle deployments only; RSA Via Lifecycle and Governance version 7.0, all patch levels hardware appliance and software bundle deployments only; RSA Identit...

CVE-2018-1182

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels hardware appliance and software bundle deployments only; RSA Via Lifecycle and Governance version 7.0, all patch levels hardware appliance and software bundle deployments only; RSA Identit...

CVE-2018-1182

CVE-2018-1182 affects EMC RSA Identity Governance and Lifecycle (versions 7.0.1 and 7.0.2), RSA Via Lifecycle and Governance (version 7.0), and RSA Identity Management & Governance (RSA IMG) (versions 6.9.0 and 6.9.1). The issue allows certain OS-level users to execute arbitrary scripts with root...

PT-2018-10833

Name of the Vulnerable Software and Affected Versions EMC RSA Identity Governance and Lifecycle versions 7.0.1 through 7.0.2 RSA Via Lifecycle and Governance version 7.0 RSA Identity Management & Governance RSA IMG versions 6.9.0 through 6.9.1 Description An issue allows certain OS level users to...

CVE-2018-1182: Improper Privilege Management

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels hardware appliance and software bundle deployments only; RSA Via Lifecycle and Governance version 7.0, all patch levels hardware appliance and software bundle deployments only; RSA Identit...

Design/Logic Flaw

Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination CWE-170 vulnerability in mingw-w64-crt libc-vsnprintf that can result in The bug may be used to corrupt subsequent string functions. This attack appear to be exploitable via Depending on the usage,...