Foxit Reader and Foxit PhantomPDF for Windows Out-of-Bounds Read Vulnerability (CNVD-2018-23237)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. An out-of-bounds read vulnerability exists in the processing of BMP images in Foxit Reader 9.2.0.9297 and earlier versions and Foxi...

IBM Security Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2018-21242)

IBM Security Key Lifecycle Manager formerly known as Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. An XML external entity injection...

nginx Data Disclosure Vulnerability

The installed version of nginx is prior to 1.12.1 or 1.13.x prior to 1.13.3. It is, therefore, affected by an integer overflow vulnerability in the range filter module. An unauthenticated, remote attacker can exploit this, via a specially crafted request to disclose potentially sensitive...

S-CMS E-commerce System SQL Injection Vulnerability in Frontend

S-CMS e-commerce system is an e-commerce software. A SQL injection vulnerability exists in the frontend of S-CMS E-commerce System. An attacker can exploit the vulnerability to obtain sensitive information from the database...

CVE-2018-15943

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure...

Vulnerability of the smp_proc_master_id function in the Android operating system, allowing a hacker to disclose protected information

The vulnerability of the smpprocmasterid function smpact.cc in the Android operating system is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information using Bluetooth...

The vulnerability of the bta_av_proc_meta_cmd function in the Android operating system, which allows a hacker to disclose protected information

The vulnerability of the btaavprocmetacmd function btaavact.cc in the Android operating system is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information using Bluetooth...

Vulnerability of the `rfc_process_mx_message` function in the Android operating system, allowing a hacker to disclose protected information

The vulnerability of the rfcprocessmxmessage function in the rfctsframes.cc library of the Android operating system arises from reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by thi...

The vulnerability of the avrc_msg_cback function in the Android operating system, allowing a hacker to disclose protected information

The vulnerability of the avrcmsgcback function in the Android operating system is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information using Bluetooth...

CVE-2018-12173

Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial ...

CVE-2018-1743

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 148422...

CVE-2018-17889

In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the XMLParser that ships with Wecon PIStudio is vulnerable to a XML external entity injection attack, which may allow sensitive information disclosure...

SQL Injection Vulnerability in WSS Project Management System Version 1.3.2 de***.php

WSS Project Management System is a browser-based collaborative office platform that integrates "Project Management", "Task Management", "Work Hour Management", "Work Log Management" and "Work Log Management". management" as one of the collaborative office platform. A SQL injection vulnerability...

CVE-2018-16049

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

Design/Logic Flaw

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

CVE-2018-16049

CVE-2018-16049 affects GitLab Community/Enterprise Edition prior to 11.0.6, 11.1.x prior to 11.1.5, and 11.2.x prior to 11.2.2. The vulnerability results in Sensitive Data Disclosure in Sidekiq Logs via an error message, with the impact described as partial confidentiality (I) and high severity i...

The vulnerability of the Windows GDI component in Windows operating systems allows attackers to disclose protected information.

The vulnerability of the Windows GDI component in Windows operating systems arises from operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created document...

CVE-2018-17215

An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained...

CVE-2018-15967

Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to information disclosure...

The vulnerability of the monitoring software for PLK Fuji Electric V-Server Lite allows a intruder to execute arbitrary code, trigger malfunctions, or disclose protected information.

The vulnerability of the monitoring software for PLCCs from Fuji Electric, V-Server Lite, is related to buffer overflow in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, cause system failures, or disclose sensitive information...