PT-2018-3863 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.16.13 Description: The issue is related to the sr do ioctl function in the Linux kernel, which allows local users to cause a denial of service or possibly have other unspecified impacts due to a stack-based...

ALPINE-CVE-2018-10754

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2018-10375

A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...

PT-2018-9782

Name of the Vulnerable Software and Affected Versions: baijiacms V3 Description: The issue allows for CSRF via the "index.php?mod=site&op=edituser&name=manager&do=user" API endpoint to add an administrator account. Recommendations: For baijiacms V3, as a temporary workaround, consider restricting...

CVE-2018-10219

CVE-2018-10219 affects baijiacms V3 and describes a physical path leakage exploitation via the request index.php?mod=mobile&name=member&do=index. Public sources (CNVD-2018-11709, NVD entry) attribute an information disclosure vulnerability to this path leakage, with the impact on confidentiality ...

CVE-2018-10222

An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=articlecategory&do=save&frame=iPHP...

PT-2018-9691

Name of the Vulnerable Software and Affected Versions: idreamsoft iCMS version 7.0.7 Description: An issue was discovered in idreamsoft iCMS, where there is a CSRF vulnerability. This vulnerability can be exploited to add an admin account via the "admincp.php?app=members&do=save&frame=iPHP"...

CVE-2018-9923

An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPHP request...

PT-2018-19091

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS versions prior to 7.0.8 Description An issue exists where CSRF is present in the admincp.php file. This can be demonstrated by adding an article via the "app=article&do=save&frame=iPHP" request to the "/admincp.php" endpoint,...

A cure for the common cold call: freeze them out

The phone rings and it's a number I don’t recognize. That’s enough to bring my mood down a few degrees. It shouldn’t, but unfortunately experience has taught me that at least 95 percent of the calls from numbers that are “private” or that I don’t have an account name stored for on my phone are...

CVE-2017-4103

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none...

CVE-2018-8721: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen...

PT-2018-18599

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 Description The issue is related to Stored XSS and is associated with the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen. Recommendations F...

Security update for postgresql95 (important)

This update for postgresql95 fixes the following issues: Upate to PostgreSQL 9.5.11: Security issues fixed: https://www.postgresql.org/docs/9.5/static/release-9-5-11.html CVE-2018-1053, boo1077983: Ensure that all temporary files made by pgupgrade are non-world-readable. boo1079757: Rename...

PT-2018-4344

Name of the Vulnerable Software and Affected Versions GNU patch versions through 2.7.6 patch in FreeBSD versions prior to 10.1-RELEASE-p17 patch in FreeBSD 10.2 versions prior to 10.2-BETA2-p3 patch in FreeBSD 10.2-RC1 versions prior to 10.2-RC1-p2 patch in FreeBSD 0.2-RC2 versions prior to...

UBUNTU-CVE-2017-7516

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-1197. Reason: This candidate is a duplicate of CVE-2015-1197. Notes: All CVE users should reference CVE-2015-1197 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

kernel: Use-after-free in the af_packet.c

It was found that fanoutadd in 'net/packet/afpacket.c' in the Linux kernel, before version 4.13.6, allows local users to gain privileges via crafted system calls that trigger mishandling of packetfanout data structures, because of a race condition involving fanoutadd and packetdobind that leads t...

kernel: Use-after-free in the af_packet.c

It was found that fanoutadd in 'net/packet/afpacket.c' in the Linux kernel, before version 4.13.6, allows local users to gain privileges via crafted system calls that trigger mishandling of packetfanout data structures, because of a race condition involving fanoutadd and packetdobind that leads t...

PT-2018-17283

Name of the Vulnerable Software and Affected Versions: AsusWRT versions prior to 3.0.0.4.384 10007 Description: An issue was discovered that allows attackers to set the admin password and launch an SSH daemon, or enable infosvr command mode, via a crafted request to the do vpnupload post function...

bosch-do-it.com XSS vulnerability

Open Bug Bounty ID: OBB-493114 Description| Value ---|--- Affected Website:| bosch-do-it.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure bas...