CVE-2018-2939

CVE-2018-2939 affects Oracle Database Server, Core RDBMS component. Affected versions: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18.1, 18.2. An attacker with Local Logon and low privileges can compromise Core RDBMS, potentially leading to unauthorized data creation/deletion/modification and the possibility o...

CVE-2018-2908

CVE-2018-2908 affects Oracle Solaris 11.3, specifically the Kernel subcomponent of the Solaris/Sun Systems Products Suite. The vulnerability allows a low-privilege, network-access attacker (via RPC) to cause a hang or frequent crash (complete DOS) on Solaris, with potential impact to other produc...

CVE-2018-3053

The CVE-2018-3053 vulnerability affects Oracle Retail Customer Management and Segmentation Foundation (Oracle Retail Applications) subcomponent Internal Operations, with affected versions 16.x and 17.x. The issue appears to be an access-control weakness that an attacker with network access over H...

CVE-2018-3060

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.22 and prior and 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2018-3087

CVE-2018-3087 affects Oracle VM VirtualBox (Core) and is fixed by upgrading to VirtualBox 5.2.16. The vulnerability is Local (attack vector: LOCAL), requires user interaction, and can lead to takeover of Oracle VM VirtualBox with High impact on confidentiality, integrity, and availability. Root c...

CVE-2018-2981

The CVE-2018-2981 entry describes a vulnerability in Oracle FLEXCUBE Universal Banking (Infrastructure) affecting multiple supported versions (11.3.0, 11.4.0, 12.0.1–12.4.0, 14.0.0, 14.1.0). A low-privilege, network-accessible attacker can exploit HTTP to compromise data. Impact includes unauthor...

CVE-2018-2940

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

CVE-2018-3036

CVE-2018-3036 affects Oracle Financial Services Applications’ Banking Corporate Lending component (Core). Affected versions: 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.1.0. The CNVD entry attributes the issue to an access-control error; NVD details describe unauthorized read, update, insert/delete, and p...

CVE-2018-2920

CVE-2018-2920 affects the Sun ZFS Storage Appliance Kit (AK) API frameworks subcomponent of Oracle Sun Systems Products Suite, with impact pre-8.7.19. A vulnerability in AK’s API frameworks could allow a low-privilege, network-accessible attacker to read, update, insert, or delete data and cause ...

CVE-2018-3040

CVE-2018-3040 affects Oracle Financial Services Applications – Banking Corporate Lending component (Core module). Affected versions include 12.3.0, 12.4.0, 12.5.0, 14.0.0 and 14.1.0. Several connected sources describe an access-control error vulnerability that can cause a denial of service (hang ...

CVE-2018-2979

CVE-2018-2979 affects Oracle FLEXCUBE Universal Banking (Infrastructure) across multiple supported versions (11.3.0, 11.4.0, 12.x up to 14.1.0). The vulnerability is a Denial of Service: a low-privileged attacker with network access via HTTP can cause a hang or frequent crash of the system. CVSS ...

CVE-2018-3000

CVE-2018-3000 affects Oracle Hospitality’s Cruise Shipboard Property Management System (SPMS Suite) within Oracle Hospitality Applications. Affects the 8.x release; vulnerability allows an unauthenticated, locally logged-on attacker to compromise SPMS, risking unauthorized access to data. CVSS v3...

CVE-2018-3078

CVE-2018-3078 affects Oracle MySQL Server (Server: DDL) with affected versions 8.0.11 and earlier. The vulnerability can be exploited by a high-privilege attacker who can access the server over multiple network protocols to cause the MySQL Server to hang or crash (complete DoS). If exploiting det...

CVE-2018-3070

CVE-2018-3070 affects Oracle MySQL Server (MySQL client mysqldump component). Affected versions are 5.5.60 and earlier, 5.6.40 and earlier, and 5.7.22 and earlier. The vulnerability is described as easily exploitable, requiring network access via multiple protocols, and can allow a low-privileged...

CVE-2018-3060

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.22 and prior and 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2018-3063

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.5.60 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2018-3075

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2018-3071

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Audit Log. Supported versions that are affected are 5.7.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attack...

Modx Revolution 2.6.4 - Remote Code Execution

Modx Revolution 2.6.4 - Remote Code Execution Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx':...

CVE-2018-3065

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DML. Supported versions that are affected are 5.7.22 and prior and 8.0.11 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...