KLA11640 Multiple vulnerabilities in Microsoft Devices

Microsoft released an advisory and security updates related to a newly discovered class of hardware vulnerabilities. Malicious can exploit these vulnerabilities to obtain sensitive information and bypass security restrictions. Original advisories ADV180012 ADV180013 Related products Windows-RT CV...

PYSEC-2018-104

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component...

8 New Spectre-Class Vulnerabilities (Spectre-NG) Found in Intel CPUs

A team of security researchers has reportedly discovered a total of eight new "Spectre-class" vulnerabilities in Intel CPUs, which also affect at least a small number of ARM processors and may impact AMD processor architecture as well. Dubbed Spectre-Next Generation, or Spectre-NG, the partial...

Trend Micro Encryption for Email Gateway formConfiguration saveValue SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within t...

Trend Micro Encryption for Email Gateway emailSearch SearchString SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL statements on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exist...

Trend Micro Encryption for Email Gateway requestDomains hidDomains SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL statements on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exist...

Trend Micro Encryption for Email Gateway editPolicy editRuleId SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

SQL Injection Vulnerability in UQCMS Cloud Business B2B2C Multi-store System Version V1.3.2_20180309

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. UQCMS cloud business B2B2C multi-store system goodsact.class page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

Quest NetVault Backup NVBUEventHistory Get Method SQL Injection (CVE-2017-17412)

An SQL injection vulnerability exists in the Server Process Manager Service of Quest NetVault Backup. The vulnerability is due to improper validation of user-supplied input on JSON-RPC requests invoking the Get method of the NVBUEventHistory class...

RHEL 6 / 7 : jboss-ec2-eap package for EAP 7.1.2 (Important) (RHSA-2018:1249)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1249 advisory. The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services AWS...

phpLiteAdmin Design Vulnerability

phpLiteAdmin is a software developer Dane Iracleous developed a set of PHP implementation and Web-based open-source SQLite database management tool . A security vulnerability exists in phpLiteAdmin versions 1.9.5 through 1.9.7.1, which stems from a failure of the program to perform an accurate...

DEBIAN-CVE-2018-10362

An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-provided login password, it is possible to login with a simpler password if the password has the form of a power in scientific notation like...

Apple iOS Telephony Denial of Service Vulnerability

Apple iOS is an operating system developed by Apple Inc. for mobile devices.APNs are a component of the push notification service.Telephony is a component that provides telephony capabilities. A security vulnerability exists in the Telephony component in Apple iOS versions prior to 11.3. A remote...

SQL Injection Vulnerability in phpComasy CMS System

phpComasy CMS is a foreign open source content management system, with simple and fast, scalable, is the ideal system for small and medium-sized websites. phpComasy CMS V2.1.1 A SQL injection vulnerability exists in the phpcomasy\classes\class.management.php file, which can be exploited by an...

Exiv2 IptcData::printStructure Out-of-Bounds Read Vulnerability

Exiv2 is a C++ library for extracting EXIF, LPTC and XMP metadata information from images. An out-of-bounds read security vulnerability exists in Exiv2 version 0.26 iptc.c/IptcData::printStructure, which can be exploited by attackers to cause a crash or information disclosure...

Oracle Java MethodHandles tryFinally Type Confusion Sandbox Escape Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation o...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2018-949)

SingleEntryRegistry incorrect setup of deserialization filter JMX, 8186998 It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass intended...

SQL injection vulnerability in admin.class.php page of UQCMS Cloud B2B2C multi-store system

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. UQCMS cloud business B2B2C multi-store system admin.class.php page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

SQL injection vulnerability in the bill.class.php page of UQCMS Cloud Business B2B2C Multi-store System

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. UQCMS cloud business B2B2C multi-store system bill.class.php page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

CVE-2018-10119

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service use-after-free with write access or possibly have unspecified other impact via a crafted...