CVE-2018-3931

In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 6,1,2018,0312, a crafted Microsoft Word DOC document can lead to an out-of-bounds write, resulting in remote code execution. This vulnerability occurs in the putShapeProperty method...

Secutech DSL WR RIS 330 Cross Site Scripting

Document Title: =============== Secutech DSL WR RIS 330 - Filter Bypass Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1988 Release Date: ============= 2018-07-09 Vulnerability Laboratory ID VL-ID: ==================================== 198...

PT-2018-16322 · Antenna House +1 · Antenna House Office Server Document Converter +1

Name of the Vulnerable Software and Affected Versions: Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 6,1,2018,0312 Description: A crafted Microsoft Word document can cause an out-of-bounds write, leading to remote code execution. The issue is related to the vbget...

USB Accessory Can Defeat iOS's New "USB Restricted Mode" Security Feature

With the release of iOS 11.4.1, Apple has finally rolled out a new security feature designed to protect your devices against USB accessories that connect to the data port, making it harder for law enforcement and hackers to break into your iPhone or iPad without your permission. Dubbed USB...

Apple Safari WebGL Out-Of-Bounds Access Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Design/Logic Flaw

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the...

CVE-2018-1000620

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the...

CVE-2018-6854

Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via multiple IOCTLs, e.g., 0x8810200B, 0x8810200F, 0x8810201B, 0x8810201F, 0x8810202B, 0x8810202F, 0x8810203F, 0x8810204B, 0x88102003,...

PT-2018-17779

Name of the Vulnerable Software and Affected Versions Sophos SafeGuard Enterprise versions prior to 8.00.5 Sophos SafeGuard Easy versions prior to 7.00.3 Sophos SafeGuard LAN Crypt versions prior to 3.95.2 Description The issue allows for Local Privilege Escalation via multiple IOCTLs. When certa...

CVE-2018-8046

The getTip method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip method of Action Column...

extjs getTip() Cross Site Scripting Vulnerability

Exploit for jsp platform in category web applications A XSS vulnerability exists in the getTip method of Action Columns. The Ext JS framework brings no built-in XSS protection, meaning that developers are responsible for sanitizing their output. However. the method above takes HTML-escaped data a...

Medtronic MyCareLink Patient Monitor Exposes Dangerous Method or Function Vulnerability

MyCareLink Patient Monitor is a patient monitor product developed by Medtronic, Inc. The Medtronic MyCareLink Patient Monitor has an Exposed Danger Method or Function vulnerability that can be exploited by an attacker with physical access to the device to access debugging functions of the monitor...

MacOS Malware Targets Cryptocurrency Community on Slack, Discord

Hackers using MacOS malware are targeting cryptocurrency investors that use both the Slack and Discord chat platforms. The malware, dubbed OSX.Dummy, uses an unsophisticated infection method, but those who are successfully attacked open their systems up to remote arbitrary code execution. “If the...

PT-2018-9485

Name of the Vulnerable Software and Affected Versions dom4j versions prior to 2.1.1 Description The issue is related to an XML Injection vulnerability in the Class: Element, specifically in the addElement and addAttribute methods. This can result in an attacker tampering with XML documents throug...

Design/Logic Flaw

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-13002

An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...

Cross site scripting

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

Design/Logic Flaw

An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...

CVE-2018-12996

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager before 13 Build 13800 allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do...

CVE-2018-12996: Improper Neutralization of Input During Web Page Generation

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager before 13 Build 13800 allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do...