CVE-2018-16471

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an...

CVE-2018-16471

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an...

CVE-2018-16471

CVE-2018-16471 (Rack XSS) Affected: Rack up to versions before 2.0.6 and 1.6.11. Issue: crafted requests can affect Rack::Request.scheme return value, enabling cross-site scripting if the value is not escaped by the app. Impact: potential XSS in apps that rely on Rack::Request.scheme without esca...

CVE-2018-7925

The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171C00 have a lock-screen bypass vulnerability. An unauthenticated attacker could start third-part input method APP through certain operations to bypass lock-screen by exploit this vulnerability...

curl: FTP path trickery leads to NIL byte out of bounds write

It was found that libcurl did not safely parse FTP URLs when using the CURLOPTFTPFILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash or an unspecified behavior...

PT-2018-3008

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.0.6 Rack versions prior to 1.6.11 Description The issue is related to a possible XSS vulnerability. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. This could lead to an X...

CVE-2018-7925: Incorrect Authorization

The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171C00 have a lock-screen bypass vulnerability. An unauthenticated attacker could start third-part input method APP through certain operations to bypass lock-screen by exploit this vulnerability...

PT-2018-18326

Name of the Vulnerable Software and Affected Versions: Huawei Emily-AL00A versions prior to 8.1.0.171C00 Description: The issue affects the radio module, allowing an unauthenticated attacker to bypass the lock screen by starting a third-party input method app through specific operations...

CVE-2018-16471: Improper Neutralization of Input During Web Page Generation

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an...

Information Disclosure

tomcat-coyote is vulnerable to information disclosure attacks. The vulnerability exists in the doRead method of Request where it fails to return a -1 when an error condition is reached, causing it to send the POST request from a different POST request...

CVE-2018-15381

A Java deserialization vulnerability in Cisco Unity Express CUE could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...

CVE-2018-15381: Deserialization of Untrusted Data

A Java deserialization vulnerability in Cisco Unity Express CUE could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...

Foscam Opticam i5 Cross-Site Scripting Vulnerability

Foscam Opticam i5 is an IP camera from FOSCAM. A persistent cross-site scripting vulnerability exists in the ONVIF devicemgmt SetHostname method of the Foscam Opticam i5 with system firmware 1.5.2.11 and application firmware 2.21.1.128. An unauthenticated attacker could exploit this vulnerability...

CVE-2018-19081

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to execute arbitrary OS commands via the IPv4Address field...

Cross site scripting

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS...

Stack overflow

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to conduct stack-based buffer overflow attacks via the IPv4Address field...

CVE-2018-19081

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to execute arbitrary OS commands via the IPv4Address field...

CVE-2018-19080

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS...

CVE-2018-19082

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to conduct stack-based buffer overflow attacks via the IPv4Address field...

Remote code execution

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation...