Security Bulletin: IBM Security Key Lifecycle Manager is affected by exposure of sensitive information to be cached by browser (CVE-2016-6097)

Summary IBM Security Key Lifecycle Manager allows web pages containing sensitive information to be cached by a browser. As a result this information will be stored unsafely for an indefinite amount of time on the user's hard drive. Attackers with local access or malware installed on the user's...

Google Android Qualcomm KGSL Driver Privilege Access Control Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, of which the Qualcomm KGSL driver is a kernel graphics driver. A privilege access control vulnerability exists in the Qualcomm KGSL driver in Android. No details of the...

CVE-2017-5447

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

SemCms foreign trade website management system suffers from overstepping access vulnerability

SemCms is an open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers. Semcms foreign trade website management system V2.7 version of the existence of ultra-rights access vulnerability , du...

CVE-2017-16104

citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

Directory traversal

wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16197

qinserve is a static file server. qinserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2018-1000181

CVE-2018-1000181 affects Kitura 2.3.0 and earlier, where an unintended read access to unauthorized files and folders can be triggered by a specially crafted URL, resulting in information disclosure. The connected documents consistently describe this as a information-disclosure vulnerability in Ki...

Google Chrome Omnibox Reference Policy Bypass Vulnerability

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 67.0.3396.62. A remote attacker can exploit the vulnerability with the help of a specially crafted website to bypass...

Yestv camera has an override access vulnerability

Yestv yestv camera is wireless network wifi smart monitor. The yestv camera is vulnerable to an override access vulnerability. With the obtained address and username password, an attacker can exploit the vulnerability to obtain video information from the camera...

IBM DB2 for Linux, UNIX and Windows File Overwrite Vulnerability (CNVD-2018-10562)

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBM i, z/OS, and Windows server versions. A security vulnerability exists in IBM DB2 including DB2 Connect Server for Linux, UNIX, and...

CVE-2018-10968

The CVE-2018-10968 issue affects D-Link DIR-550A and DIR-604M (through v2.10KR). A backdoor-like vulnerability allows a malicious user to access vulnerable devices via a default TELNET account, enabling unauthorized access. Technical details in CNVD/CVE records confirm affected models and version...

GitLab Enterprise Edition (EE) Unauthorized Repository Access Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has features similar to Github for accessing the contents of a project's files, commit history, bug lists, etc. GitLab Enterprise Edition EE is...

Override Access Vulnerability in the Swish Open App

Swish and Drive App is a rental car for traveling. A vulnerability exists in Swish and Drive APP. An attacker can gain access to sensitive information by grabbing packets and modifying IDs...

Design/Logic Flaw

On F5 BIG-IP 13.0.0-13.1.0.5 or 12.0.0-12.1.3.3, malicious root users with access to a VCMP guest can cause a disruption of service on adjacent VCMP guests running on the same host. Exploiting this vulnerability causes the vCMPd process on the adjacent VCMP guest to restart and produce a core fil...

CVE-2017-17314

The CVE-2017-17314 issue affects Huawei DP300, RP200, TE30/TE40/TE50/TE60 platforms (versions listed in the initial entry). It is an invalid memory access vulnerability caused by insufficient input validation of certain fields in malformed SCCP messages, which unauthenticated attackers can send t...

CVE-2017-17314

Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C10, V500R002C00, V600R006C00 have an invalid memory access vulnerability. An unauthenticated attacker has to find a way to send...

Oracle Enterprise Manager Ops Center Component Remote Vulnerability

Oracle Enterprise Manager Products Suite is a set of Oracle's on-premise management platform. Enterprise Manager Ops Center is one of the enterprise data center monitoring and management components. A security vulnerability exists in the Framework subcomponent of the Enterprise Manager Ops Center...

CVE-2018-2854

Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications subcomponent: Portfolio, Attribution. The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network...

UBUNTU-CVE-2018-2777

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...