CVE-2018-1000833

ZoneMinder is affected by an object-injection vulnerability tracked as CVE-2018-1000833, affecting ZoneMinder versions <= 1.32.2 (also reported by OpenVAS as ZoneMinder

CVE-2018-1000832

ZoneMinder version = 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

CVE-2018-1000832

CVE-2018-1000832 affects ZoneMinder versions

CVE-2018-1000833

ZoneMinder version = 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

Privilege escalation

A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated sudo permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions an...

CVE-2018-2486

SAP Marketing UICUAN 1.20, 1.30, 1.40, SAPSCORE 1.13, 1.14 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Debian DSA-4347-1 : perl - security update

Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2018-18311 Jayakrishna Menon and Christophe Hauser discovered an integer overflow vulnerability in Perlmysete...

Cross-Site Scripting in html-janitor

Versions of html-janitor prior to 2.0.2 all current versions are vulnerable to cross-site scripting XSS. This is exploitable if user-controlled data is passed into the modules clean function. Recommendation No fix is currently available for this vulnerability. It is recommended to use an...

GHSA-HFJ4-96F7-6R5G Cross-Site Scripting in html-janitor

Versions of html-janitor prior to 2.0.2 all current versions are vulnerable to cross-site scripting XSS. This is exploitable if user-controlled data is passed into the modules clean function. Recommendation No fix is currently available for this vulnerability. It is recommended to use an...

Yammer Desktop Application Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Yammer desktop application due to the loading of arbitrary content. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user...

CVE-2018-0381

A vulnerability in the Cisco Aironet Series Access Points APs software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is due to a deadlock condition that may occur when an affect...

Helm Wants You to Control Your Own Data Again

Helm hopes to make running your own private, encrypted server easy for everyone...

Oracle Java Usage Tracker usagetracker.properties Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Oracle Java. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of a...

Dark web kingpin visiting US for beard competition gets 20 years in prison

By Waqas Dream Market Drug Vendor arrived in the US to participate in a beard competition in Texas. A Dark Web drug dealer has received 240 months or 20 years in prison after he pleaded guilty to the crimes of laundering money and possessing controlled substances with the intention of distributin...

Input validation

Improper input validation in obs-service-tarscm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12474 Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm

Improper input validation in obs-service-tarscm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to...

Sql injection

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...

Linux 4.18 - Arbitrary Kernel Read into dmesg via Missing Address Check in segfault Handler

Exploit for linux platform in category dos / poc There is a missing address check in both showopcodes callers. showopcodes is mostly used by the kernel to print the raw instruction bytes surrounding an instruction that generated an unexpected exception; however, sometimes it is also used to print...

GHSA-5CV7-R488-WC5X noderequest is malware

The noderequest package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security...

Linux 4.18 - Arbitrary Kernel Read into dmesg via Missing Address Check in segfault Handler

There is a missing address check in both showopcodes callers. showopcodes is mostly used by the kernel to print the raw instruction bytes surrounding an instruction that generated an unexpected exception; however, sometimes it is also used to print userspace instructions. Because the userspace...