CVE-2018-3130

Vulnerability in the PeopleSoft Enterprise Interaction Hub component of Oracle PeopleSoft Products subcomponent: Application Portal. The supported version that is affected is 9.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2018-3230

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware subcomponent: Outside In Filters. The supported version that is affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2018-3242

CVE-2018-3242 affects Oracle E-Business Suite Marketing Administration (Marketing component). Affected are versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise Oracle Marketing,...

CVE-2018-3166

The CVE-2018-3166 vulnerability affects Oracle Hospitality Applications’ Hospitality Cruise Fleet Management component (Emergency Response System) version 9.0. It allows a low-privilege, network-accessible attacker over HTTP to modify or delete data, with an impact on data integrity (CVSSv3.0: 6....

CVE-2018-3276

CVE-2018-3276 affects the Oracle MySQL Server component (subcomponent: Server: Memcached). Affected are MySQL versions 5.6.41 and prior, 5.7.23 and prior, and 8.0.12 and prior. The vulnerability allows a high-privilege attacker with network access via multiple protocols to compromise the MySQL Se...

CVE-2018-2909

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

CVE-2018-3148

CVE-2018-3148 affects Oracle Primavera Unifier (Web Access subcomponent). Affected versions: 15.1, 15.2, 16.1, 16.2, 17.1–17.12 and 18.1–18.8. The vulnerability is exploitable by an unauthenticated attacker over HTTP with network access; successful exploitation may require user interaction. Impac...

CVE-2018-3282

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Storage Engines. Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network acce...

CVE-2018-3200

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2018-3277

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2018-3129

The CVE-2018-3129 entry concerns Oracle PeopleSoft Enterprise PeopleTools Portal (PeopleTools component). Affected products/versions are PeopleSoft Portal, versions 8.55, 8.56 and 8.57. The vulnerability allows an unauthenticated, network-accessible attacker to exploit over HTTP, with user intera...

CVE-2018-3140

CVE-2018-3140 affect: Oracle Hyperion Essbase Administration Services (EAS) Console, part of Hyperion Essbase Administration Services. The vulnerability is exploitable via HTTP without authentication on affected 11.1.2.4 deployments. Successful exploitation can lead to unauthorized update/insert/...

CVE-2018-3133

CVE-2018-3133 concerns Oracle MySQL Server (subcomponent: Server: Parser). Affected are MySQL Server versions 5.5.61 and earlier, 5.6.41 and earlier, 5.7.23 and earlier, and 8.0.12 and earlier. An attacker with network access via multiple protocols and low privileges can trigger a hang or frequen...

CVE-2018-3296

CVE-2018-3296 affects Oracle VM VirtualBox (Core) with vulnerabilities fixed in VirtualBox 5.2.20 and later. Affected: Oracle VM VirtualBox prior to 5.2.20. Impact: takeover of VirtualBox with HIGH confidentiality, integrity, and availability implications. Vector/conditions: unauthenticated attac...

LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: LCDS – Leão Consultoria e Desenvolvimento de Sistemas LTDA ME Equipment: LAquis SCADA Vulnerabilities: Untrusted Pointer Dereference, Out-of-Bounds Read, Integer Overflow to Buffer Overflow, Path...

Shopify: H1514 Server Side Template Injection in Return Magic email templates?

Summary: Possible template injection in return magic email templates. Description: I've been playing with return magic workflow email templates and there seems to be some kinda of template injection but I am not sure if it's exploitable or even valid. Here is why I think it could be vulnerable: I...

Nuuo Central Management Server Authenticated Arbitrary File Upload

The COMMITCONFIG verb is used by a CMS client to upload and modify the configuration of the CMS Server. The vulnerability is in the "FileName" parameter, which accepts directory traversal ....\ characters. Therefore, this function can be abused to overwrite any files in the installation drive of...

Solaris 10 (sparc) : 150400-63

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Kernel. Supported versions that are affected are 10 and 11.3. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris...

CVE-2018-0052

If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH service is disabled by default on Junos. There is no documented CLI command to enable this service. However, an undocumented CLI command...

Authentication flaw

If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH service is disabled by default on Junos. There is no documented CLI command to enable this service. However, an undocumented CLI command...