CVE-2018-3883

CVE-2018-3883 concerns ERPNext v10.1.6 with exploitable SQL injection in the authenticated area. The TALOS/NVD analyses confirm vulnerable parameters include employee and sort_order (and related endpoints such as _cmd=erpnext.hr.doctype.leave_application.leave_application and _cmd=erpnext.stock.d...

CVE-2018-3884

CVE-2018-3884 pertains to ERPNext v10.1.6 where the authenticated UI exposes SQL injection in the stock dashboard’s data retrieval. The vulnerability is triggered via the sort_by parameter (and related input paths in the Talos report) through normal web requests, potentially enabling data exposur...

CVE-2018-3883

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...

CVE-2018-3884

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sortby and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to...

Microsoft Office Multiple Vulnerabilities (Sep 2018) - Mac OS X

This host is missing an important security update for Microsoft Office 2016 on Mac OS X according to Microsoft security update September 2018 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Someone Hijacked MEGA Chrome Extension to Steal Users' Passwords

Warning! If you are using Chrome browser extension from the MEGA file storage service, uninstall it right now. The official Chrome extension for the MEGA.nz cloud storage service had been compromised and replaced with a malicious version that can steal users' credentials for popular websites like...

ERPNext SQL Injection Vulnerabilities

Summary Exploitable SQL injection vulnerabilities exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required. Tested...

JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

Amazon Linux AMI : mysql55 (ALAS-2018-1068)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Options. Supported versions that are affected are 5.5.60 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

Cheddar’s Restaurants Bitten By Credit-Card Breach

Fast-casual stalwart Cheddar’s Scratch Kitchen has become the latest restaurant to suffer a payment-card breach. Cheddar’s, known for its reasonably priced country-fried chicken, pot pies, ribs and other comfort food, has hundreds of locations across the Midwest and the South. It said that it...

‘China’s MIT’ Linked to Espionage Campaign Against Alaska, Economic Partners

An extensive cyberespionage campaign was disclosed today, targeting high-value international and U.S. government agencies and companies and emanating from an IP address associated with Tsinghua University, colloquially known as “China’s MIT.” The actors have gone after a range of targets, includi...

Security Updates for Microsoft Excel Products (August 2018)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the...

coffescript is malware

The coffescript package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation If you have found coffescript installed in your...

CVE-2018-3109

CVE-2018-3109 affects Oracle Fusion Middleware MapViewer (Map Builder) in versions 12.2.1.2 and 12.2.1.3. The vulnerability exists in the MapViewer component and is exploitable by a low-privilege attacker over HTTP with network access, potentially leading to unauthorized reading of data or access...

CVE-2018-3108

CVE-2018-3108 affects Oracle Fusion Middleware (Oracle Notification Service subcomponent) in versions 12.2.1.2 and 12.2.1.3. The flaw is exploitable by a low-privileged attacker who can access the service over HTTPS and can lead to unauthorized access to data across Oracle Fusion Middleware. The ...

CVE-2018-3881

An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially crafted web request to FocalScope's server that could cause an XXE, and potentially result in data compromise...

Xxe

An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially crafted web request to FocalScope's server that could cause an XXE, and potentially result in data compromise...

CVE-2018-3881

CVE-2018-3881 affects FocalScope v2416 and earlier: an unauthenticated XML External Entity (XXE) vulnerability that allows a crafted XML payload to cause data disclosure. TALOS details show the vulnerability is triggered via POST to /emm/cros /xlogin.asp with a crafted XML document, demonstrating...