PT-2019-1334 · Oracle +1 · Mysql Server

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.13 and prior Description: The issue is related to insufficient access control in the MySQL Server component, specifically in the Shell subcomponent. It allows an attacker with low privileges and logon to the...

Subsonic v6.1.5 - Server Side Request Forgery & CSRF

Document Title: =============== Subsonic v6.1.5 - Server Side Request Forgery & CSRF References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2175 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20228 CVE-ID: ======= CVE-2018-20228 Release Date:...

Subsonic v6.1.5 - Server Side Request Forgery & CSRF

Document Title: =============== Subsonic v6.1.5 - Server Side Request Forgery & CSRF References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2175 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20228 CVE-ID: ======= CVE-2018-20228 Release Date:...

mysql: Server: DDL unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DDL. Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

mysql: InnoDB unspecified vulnerability (CPU Oct 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Security : Privileges. Supported versions that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

Weak Password Vulnerability in Maipu Switches

Mapper switches generally have weak passwords, and then you can go in and perform any operation with a low-privilege user. This is based on http basic authentication http://111.50.98.155:80 http://111.50.98.151:80 http://111.50.98.154:80 admin/admin...

Tmp files readable by other users in sync-exec

Affected versions of sync-exec use files located in /tmp/ to buffer command results before returning values. As /tmp/ is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via sync-exec under a higher privilege...

CVE-2018-1802

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640...

CVE-2018-7718

An issue was discovered in Telexy QPath 5.4.462. A low privileged authenticated user supplying a specially crafted serialized request to AdanitDataService.svc may modify user information, including but not limited to email address, username, and password, of other user accounts. The simplest atta...

PT-2018-14321 · Citrix · Citrix Xen Mobile

Name of the Vulnerable Software and Affected Versions: Citrix Xen Mobile versions through 10.8 Description: The issue allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000, and 30001. The vendor disputes that thi...

CVE-2018-15366

A UrlfWTPPagePtr KERedirect Use-After-Free Privilege Escalation vulnerability in Trend Micro Antivirus for Mac Consumer 7.0 2017 and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on t...

CVE-2018-3264

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Kernel. The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successf...

CVE-2018-3249

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services. The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2018-3211

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Serviceability. Supported versions that are affected are Java SE: 8u182 and 11; Java SE Embedded: 8u181. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where...

CVE-2018-3208

Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion subcomponent: Access and Security. The supported version that is affected is 11.1.2.4.345. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hyperion Da...

CVE-2018-3181

Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications subcomponent: OHC ENOAD. The supported version that is affected is 8.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure...

CVE-2018-3166

Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications subcomponent: Emergency Response System. The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2018-3159

Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications subcomponent: Sender and Receiver. The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where...