CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

UBUNTU-CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

DEBIAN-CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

PT-2018-3481 · Graphicsmagick +3 · Graphicsmagick +3

Name of the Vulnerable Software and Affected Versions: GraphicsMagick version 1.3.31 Description: The issue is related to the ReadDIBImage function in GraphicsMagick, which lacks proper input validation. This can be exploited by a remote attacker using a specially crafted dib file, potentially...

Code injection

A design flaw in the BlinkForHome aka Blink For Home Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips triggered by the motion sensor are not saved if the attacker's traffic such as Dot11Deauth successfully disconnects the Sync Module from the...

CVE-2018-20161

A design flaw in the BlinkForHome aka Blink For Home Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips triggered by the motion sensor are not saved if the attacker's traffic such as Dot11Deauth successfully disconnects the Sync Module from the...

CVE-2018-20161

A design flaw in the BlinkForHome aka Blink For Home Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips triggered by the motion sensor are not saved if the attacker's traffic such as Dot11Deauth successfully disconnects the Sync Module from the...

The vulnerability of the DLL component of Cisco AMP’s security tools for end devices allows a malicious actor to disable the security services and system scanning functions.

The vulnerability of the DLL component used by Cisco AMP’s security tools for end devices relates to resource management errors. Exploiting this vulnerability allows a malicious actor to remotely disable security services and system scanning services using a specially crafted DLL file...

PT-2018-2780 · Mcafee · Mcafee Agent

Name of the Vulnerable Software and Affected Versions: McAfee Agent versions prior to 5.6.0 Description: The issue is related to a use after free vulnerability in the client component of McAfee Agent. This can be exploited by sending specially crafted HTTP requests, potentially allowing a remote...

PT-2018-3866 · Exiv2 +6 · Exiv2 +6

Name of the Vulnerable Software and Affected Versions: Exiv2 version 0.27-RC3 Description: The issue is related to a buffer overflow in the tiffimage int.cpp component of the Exiv2 library, which can lead to a remote denial of service attack when a crafted input is processed. This can cause a SEG...

RCE in PHP or how to bypass disable_functions in PHP installations

Today we will explore an exciting method to remotely execute code even if an administrator set disablefunctions in the PHP configuration file. It works at most popular UNIX-like systems. CVE-2018–19518 was assigned to the vulnerability was found by a man with the @crlf nickname. Let’s see details...

PT-2018-17482 · Facebook · Hhvm

Name of the Vulnerable Software and Affected Versions: HHVM versions 3.24.3 and 3.21.7 and below Description: A potential denial-of-service issue exists in the Proxygen handling of invalid HTTP2 settings, causing the server to spend disproportionate resources when handling HTTP2 requests using th...

PT-2018-2000 · Kubernetes · Minikube

Name of the Vulnerable Software and Affected Versions: minikube versions 0.3.0 through 0.29.0 Description: The issue is related to privilege management errors in the minikube command-line utility. It allows a remote attacker to execute arbitrary code. In certain VM environments where the IP is ea...

Security fix for the ALT Linux 10 package node version 10.14.1-alt1

Nov. 30, 2018 Vitaly Lipatov 10.14.1-alt1 - new version 10.14.1 with rpmrb script - disable internal doc - 2018-11-27, Version 10.14.0 'Dubnium' LTS, @rvagg - CVE-2018-12121, CVE-2018-12122, CVE-2018-12123...

PT-2018-3075 · Audiocoding +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: Freeware Advanced Audio Decoder 2 FAAD2 version 2.8.8 Description: The issue is related to an invalid memory address dereference in the hf assembly function, which can cause a segmentation fault and application crash, leading to denial of...

The vulnerability of Cisco Immunet and Cisco Advanced Malware Protection’s scanning components allows attackers to disable the scanning service.

The vulnerability of Cisco Immunet and Cisco Advanced Malware Protection scanning components is related to an uncontrolled consumption of resources. Exploiting this vulnerability could allow a hacker to disable the scanning service using a specially crafted file...

PT-2018-3680 · Google +9 · Libwebp +9

Name of the Vulnerable Software and Affected Versions: libwebp versions prior to 1.0.1 Description: A heap-based buffer overflow was found in the ApplyFilter function, which can be exploited by creating a specially crafted file, allowing a remote attacker to access confidential information. This...

PHP 5.2.3 imap (Debian Based) - imap_open Disable Functions Bypass Vulnerability

Exploit for linux platform in category local exploits PHP 5.2.3 imap Debian Based - imapopen Disable Functions Bypass Vulnerability /tmp/test0001 $server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh"; imapopen''.$server.':143/imapINBOX', '', '' or...

PHP 5.2.3 imap (Debian Based) - imap_open Disable Functions Bypass

PHP 5.2.3 imap Debian Based - imapopen Disable Functions Bypass /tmp/test0001 $server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh"; imapopen''.$server.':143/imapINBOX', '', '' or die"\n\nError: ".imaplasterror;...

PT-2018-3329

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 31.0.0.153 and earlier Adobe Flash Player versions 31.0.0.108 and earlier Description: The issue is related to a use-after-free vulnerability in Adobe Flash Player. Successful exploitation could lead to arbitrary...