RHEL 6 : chromium-browser (RHSA-2018:0334)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:0334 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 64.0.3282.167. Security Fixes:...

SQL injection vulnerability in UQCMS cloud B2B2C multi-store system caiji.class.php page

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. A SQL injection vulnerability exists in the caiji.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System due to the program's failure to adequately filter user-suppli...

SQL injection vulnerability in the goods_order.class.php page of the B2B2C multi-store system of UQCMS Cloud Commerce (CNVD-2017-37553)

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. A SQL injection vulnerability exists in the goodsorder.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System due to the program's failure to adequately filter...

OPENSUSE-SU-2018:0453-1 Security update for chromium

This update for chromium to version 64.0.3282.167 fixes the following issue: CVE-2018-6056: Incorrect derived class instantiation in V8 bsc1080920...

CVE-2018-6876

The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers to cause a denial of service stack-based buffer under-read via a crafted bmp image...

CVE-2018-6880

EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php...

Code injection

EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php...

EmpireCMS class/connect.php File Path Leakage Vulnerability

EmpireCMS is a free CMS Content Management System. A security vulnerability exists in EmpireCMS versions 6.6 through 7.2. The vulnerability can be exploited by a remote attacker to obtain the full path with the help of the class/connect.php file...

ImageMagick Buffer Overflow Vulnerability (CNVD-2018-05481)

ImageMagick is the United States ImageMagick Studio, Inc. of a set of open source image processing software. The software can read, convert, write images in a variety of formats. libfpx is used in one of the open source Flashpix image support library . A buffer overflow vulnerability exists in th...

Stack overflow

The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers to cause a denial of service stack-based buffer under-read via a crafted bmp image...

CVE-2018-6876

CVE-2018-6876: The OLEProperty class in ole/oleprop.cpp (libfpx 1.3.1-10), used by ImageMagick 7.0.7-22 Q16 and other products, can be triggered by a crafted BMP image to cause a remote stack-based buffer under-read, leading to denial of service. This vulnerability is documented in Nessus plugin ...

CVE-2018-6876

The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers to cause a denial of service stack-based buffer under-read via a crafted bmp image...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2018-949)

SingleEntryRegistry incorrect setup of deserialization filter JMX, 8186998 It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass intended...

Joomla! 1.5.0 < 3.8.4 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is 1.5.0 or later but prior to 3.8.4. It is, therefore, affected by multiple XSS and SQLi vulnerabilities : - The XSS vulnerability in module chromes as noted in the 20180101 announcement...

Joomla! cross-site scripting vulnerability (CNVD-2018-04201)

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other features . Uri class is one of the analytics resources unified identifier component . A cross-site scripting vulnerability exists in Uri...

CVE-2018-6379

CVE-2018-6379 affects Joomla! up to version 3.8.3, due to inadequate input filtering in the Uri (JUri) class, enabling XSS. Affected range: 1.5.0–3.8.3; fixed in 3.8.4. Connected scans confirm the Uri class XSS (CVE-2018-6379) among Joomla! vulnerabilities; no exploitation details provided in the...

OpenJDK: loading of classes from untrusted locations (I18n, 8182601)

It was discovered that the I18n component of OpenJDK could use an untrusted search path when loading resource bundle classes. A local attacker could possibly use this flaw to execute arbitrary code as another local user by making their Java application load an attacker controlled class file...

Sangoma NetBorder / Vega Session Controller Remote Command Execution

Description Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote unauthenticated attackers to execute arbitrary commands via the web interface. Technical Details The ShellExec class implemented in api/ShellExec.class.php is extensively used by various PHP scripts in the...

DRUPAL-CONTRIB-2018-001

This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets. The module does not sufficiently filter values posted to its AJAX endpoint, which leads to the instantiation of an arbitrary PHP class. This vulnerability ...

Debian DLA-1236-1 : plexus-utils security update

Charles Duffy discovered that the Commandline class in plexus-utils, a collection of components used by Apache Maven, does not correctly quote the contents of double-quoted strings. An attacker may use this flaw to inject arbitrary shell commands. For Debian 7 'Wheezy', these problems have been...