CVE-2018-1000529

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting XSS vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8...

CVE-2018-1000559

qutebrowser version introduced in v0.11.0 1179ee7a937fb31414d77d9970bac21095358449 contains a Cross Site Scripting XSS vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h. Remediation There is no fixed version for tinyexr. References - GitHub Issue...

IPConfigure Orchid VMS 2.0.5 Directory Traversal / Information Disclosure

require 'msf/core' class MetasploitModule 'IPConfigure Orchid VMS %q Orchid Core VMS is vulnerable to a directory traversal attack. This affects Linux and Windows operating systems. This allows a remote, unauthenticated attacker to send crafted GET requests to the application, which results in th...

Security Bulletin: A vulnerability in glibc affects IBM Flex System Manager (FSM) (CVE-2017-1000366)

Summary A vulnerability has been discovered in glibc that is embedded in FSM. This bulletin addresses that issue. Vulnerability Details CVEID: CVE-2017-1000366 DESCRIPTION: Glibc could allow a local attacker to execute arbitrary code on the system, caused by a vulnerability that allows specially...

Security Bulletin: Vulnerability in OpenSSL affects Tivoli Storage FlashCopy Manager Unix and VMware (CVE-2015-1788)

Summary An OpenSSL denial of service vulnerability disclosed by the OpenSSL Project affects GSKit. Tivoli Storage Manager Unix and VMware are affected as GSKit is used for communication between FCM components. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a deni...

Security Bulletin: Multiple Vulnerabilities in Oracle Outside In Technology affects IBM Rational DOORS Next Generation (CVE-2017-10141, CVE-2017-10196)

Summary IBM Rational DOORS Next Generation® is affected by multiple vulnerabilities in the Oracle Outside In Technology® that is used as a component. Vulnerability Details CVE-ID: CVE-2017-10141 Description: An unspecified vulnerability in Oracle Fusion Middleware related to the Outside In...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h. Remediation There is no fixed version for tinyexr. References - Github.com - GitHub Issue...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Dynamic Process Edition: CVE-2015-1920

Summary WebSphere Application Server is shipped as a component of WebSphere Dynamic Process Edition. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security...

OX App Suite 7.8.4 - Multiple Vulnerabilities

OX App Suite 7.8.4 - Multiple Vulnerabilities Product: OX App Suite Vendor: OX Software GmbH Internal reference: 55872 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.8.4 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code. Remediation There is no fixed version for tinyexr. References - GitHub Issue...

Resource Management Errors

Overview Affected versions of this package are vulnerable to Resource Management Errors tinyexr 0.9.5 has a memory leak in ParseEXRHeaderFromMemory in tinyexr.h. Remediation There is no fixed version for tinyexr. References - GitHub Issue...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h. Remediation There is no fixed version for tinyexr. References - Github.com...

[SECURITY] [DSA 4207-1] packagekit security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4207-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 22, 2018 https://www.debian.org/security/faq -...

Resource Management Errors

Overview Affected versions of this package are vulnerable to Resource Management Errors sas/readstatsas7bcatread.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop. Remediation There is no fixed version for readstat. References - Github.com...

Resource Management Errors

Overview Affected versions of this package are vulnerable to Resource Management Errors savparsemachineintegerinforecord in spss/readstatsavread.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconvopen call. Remediation There is no fixed version for readstat. References -...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. An issue was discovered in PoDoFo 0.9.5. The function PdfDocument::Append in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service NULL pointer dereference and application crash v...

RSA Authentication Manager XML Injection / Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XXE & XSS vulnerabilities product: RSA Authentication Manager vulnerable version: 8.2.1.4.0-build1394922, 8.3 P1 fixed version: 8.3 P1 and later CVE number: CVE-2018-1247...

CVE-2018-10164

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the implementation of portalPictureUpload functionality. This is fixed in version...

Cross site scripting

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version...