CVE-2018-2844

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBo...

CVE-2018-2842

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBo...

UBUNTU-CVE-2018-2762

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQ...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2018-08800)

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Windows kernel is one of the Windows system kernels. An information disclosure vulnerability exists in Microsoft Windows kernel. An attacker can exploit this vulnerability by logging on...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2018-08334)

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Windows kernel is one of the Windows system kernels. An information disclosure vulnerability exists in Microsoft Windows kernel. An attacker can exploit this vulnerability by logging on...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2018-08569)

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Windows kernel is one of the Windows system kernels. An information disclosure vulnerability exists in Microsoft Windows kernel. An attacker can exploit this vulnerability by logging on...

Cybozu Garoon Browsing Restriction Bypass Vulnerability (CNVD-2018-08809)

Cybozu Garoon is an office software with Chinese, Japanese, and English languages. A browsing restriction bypass vulnerability exists in the application "Cabinet" in Cybozu Garoon 3.5.0 through 4.6.1. The vulnerability can be exploited by users who can log in to the product to view folder names...

Cybozu Garoon Browsing Restriction Bypass Vulnerability

Cybozu Garoon is an office software with Chinese, Japanese, and English languages. A browsing restriction bypass vulnerability exists in the application "Space" in Cybozu Garoon 4.0.0 through 4.6.0. The vulnerability can be exploited by users who can log in to the product to view the closed...

Information disclosure

An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealmauthContext that allows attackers with local file system access to obtain a list of authorities for logged in users...

Microsoft Windows Storage Services Elevation of Privilege Vulnerability (CNVD-2018-05839)

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Windows Storage Services is one of the system storage services. An elevation of privilege vulnerability exists in Microsoft Windows Storage Services, which results from the program...

JVN#60032768: WordPress plugin "WP All Import" vulnerable to cross-site scripting

The WordPress plugin "WP All Import" provided by Soflyy contains a reflected cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged in user's web browser. Solution Update the plugin Update the plugin according to the information provided by the developer...

Microsoft Windows Storage Services Elevation of Privilege Vulnerability

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. Windows Storage Services is one of the system storage services. An elevation of privilege vulnerability exists in Microsoft Windows Storage Services, which arises from the program's failure to properl...

Scan Logged-out Intermittently

This plugin is raised when the scanner detected that it has been logged out during the scan, but has been able to authenticate back against the web application using the options provided in the scan policy. Such case may occur if the scanner accesses a link that led the session to be closed. Chec...

CVE-2018-5550

Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting XSS vulnerability, which can allow untrusted users on the network to hijack a session cookie or perform other reflected XSS attacks on a currently logged-on user...

App password scope can be changed for other users (NC-SA-2018-001)

A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user...

mysql: Server: Error Handling unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Error Handling. Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the...

WordPress plugin "WP Retina 2x" vulnerable to cross-site scripting

Overview The WordPress plugin "WP Retina 2x" contains a reflected cross-site scripting vulnerability CWE-79. Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may be executed on a...

Input validation

DISPUTED In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their...

CVE-2018-2685

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBo...

UBUNTU-CVE-2018-2676

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBo...