CVE-2018-16831

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusteddir protection mechanism via a file:./../ substring in an include statement...

CVE-2018-16831: Improper Limitation of a Pathname to a Restricted Directory

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusteddir protection mechanism via a file:./../ substring in an include statement...

CVE-2018-15684

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

PT-2018-13143

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT affected versions not specified Description An issue in BTITeam XBTIT allows PHP error logs to be stored in an open directory /include/logs with predictable file names. This can lead to full path disclosure and the leakage of...

CVE-2018-16343

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

CVE-2018-16343

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

CVE-2018-16343

SeaCMS 6.61 contains a remote code execution flaw: the parseIf() function in include/main.class.php fails to block use of $GLOBALS, enabling attackers to run arbitrary code. This has been documented across multiple sources (CNVD-2018-19075 and NVD/NVD-derived entries) and is tied to SeaCMS’s PHP ...

PT-2018-13522

Name of the Vulnerable Software and Affected Versions OnlineJudge version 2.0 Description The issue concerns an incorrect access control vulnerability in the sandbox of OnlineJudge. This vulnerability allows a user to write a file anywhere, including writing a directory listing to /tmp...

PT-2018-13503

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.61 Description The issue allows remote attackers to execute arbitrary code. This is due to the parseIf function in include/main.class.php not blocking the use of $GLOBALS. Recommendations For SeaCMS version 6.61, consider...

CVE-2018-16343: Improper Control of Generation of Code

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

Microsoft Outlook 365 - Arbitrary File Upload Vulnerability

Document Title: =============== Microsoft Outlook 365 - Arbitrary File Upload Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1513 Release Date: ============= 2018-08-08 Vulnerability Laboratory ID VL-ID: ===================================...

Security update for cups (moderate)

This update for cups fixes the following issues: The following security vulnerabilities were fixed: - CVE-2017-18248: Handle invalid characters properly in printing jobs. This fixes a problem that was causing the DBUS library to abort the calling process. bsc1061066 bsc1087018 - Fixed a local...

Null pointer dereference

An issue was discovered in libthulac.so in THULAC through 2018-02-25. A NULL pointer dereference can occur in the BasicModel class in include/cbmodel.h...

CVE-2018-14564

An issue was discovered in libthulac.so in THULAC through 2018-02-25. A SEGV can occur in NGramFeature::findbases in include/cbngramfeature.h...

CVE-2018-14562

An issue was discovered in libthulac.so in THULAC through 2018-02-25. A NULL pointer dereference can occur in the BasicModel class in include/cbmodel.h...

CVE-2018-14562: NULL Pointer Dereference

An issue was discovered in libthulac.so in THULAC through 2018-02-25. A NULL pointer dereference can occur in the BasicModel class in include/cbmodel.h...

CVE-2018-14564: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in libthulac.so in THULAC through 2018-02-25. A SEGV can occur in NGramFeature::findbases in include/cbngramfeature.h...

USN-3713-1 cups vulnerabilities

It was discovered that CUPS incorrectly handled certain print jobs with invalid usernames. A remote attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 17.10 and Ubuntu 18.04 LTS. CVE-2017-18248 Dan...

PT-2018-2733

Name of the Vulnerable Software and Affected Versions macOS High Sierra versions prior to 10.13.5 Description The issue is related to the CUPS print server and involves improper handling of certain include directives, allowing an unprivileged user to read arbitrary files as a superuser. This...

CVE-2018-11588

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php...