Zoho ManageEngine OpManager SQL Injection Vulnerability (CNVD-2018-26464)

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A SQL injection vulnerability exists in the Alarms section of ZOHO ManageEngine OpManager prior to version 12.3 build 123239. A remote attacker can exploit this vulnerability to execute...

UBUNTU-CVE-2018-18343

Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

UBUNTU-CVE-2018-18357

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted domain name...

chromium-browser: Use after free in Blink

Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

LibRaw 'nikon_coolscan_load_raw()' function memory out-of-bounds read vulnerability

LibRaw is a C++ library developed by the LibRaw team for processing RAW CRW/CR2, NEF, RAF, DNG and others format images. A security vulnerability exists in the 'nikoncoolscanloadraw' function in the internal/dcrawcommon.cpp file in LibRaw versions prior to 0.18.9. A remote attacker can exploit th...

Google Chrome Proxy Unauthorized Access Vulnerability

Google Chrome is a web browser developed by Google, Inc. and Proxy is one of the proxy components. A security vulnerability exists in Proxy in Google Chrome versions prior to 71.0.3578.80, which stems from insufficient policy enforcement. The vulnerability can be exploited to gain unauthorized...

CVE-2018-9084

In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...

CVE-2018-9073

Lenovo Chassis Management Module CMM prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets...

Nextcloud Server Privilege Authentication Vulnerability (CNVD-2019-18774)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform.Nextcloud Server is one of the server version. A privilege validation vulnerability exists in versions of Nextcloud Server prior to 14.0.0 that can be exploited by an attacker to bypa...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2018-21847)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 63. A remote attacker could exploit this vulnerability to cause a denial of service...

chromium-browser: URL spoof in Omnibox

Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

GHSA-P699-3WGC-7H72 org.apache.tika:tika-parsers has an Infinite Loop vulnerability

Versions of the package org.apache.tika:tika-parsers before version 1.18 are vulnerable to Denial of Service DoS via a carefully crafted or fuzzed file that can trigger an infinite loop via the ChmParser...

UBUNTU-CVE-2018-3292

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

ALPINE-CVE-2018-16737

tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation...

CVE-2018-6049

Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is granted via a crafted HTML page...

CVE-2018-6501

Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center ArcMC for versions prior to 2.81. This vulnerability could be exploited to allow for insufficient access controls...

Apple iOS and tvOS Messages and Safari Information Disclosure Vulnerability

Apple iOS and tvOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. tvOS is an operating system for smart TVs. messages is a messaging component; Safari is a browser component. A security vulnerability exists in the Messages component in Apple iOS...

MyBB Cross-Site Scripting Vulnerability (CNVD-2018-19562)

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is easy to use , multi-language support , scalable , etc. Visual Editor is one of the HTML editor component . A cross-site scripting vulnerability exists in Visual Editor in...

UBUNTU-CVE-2017-15416

Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read...

CloudBees jenkins-email-ext Email Extension plugin information disclosure vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . jenkins-email-ext is...