PYSEC-2018-50

In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master...

tcpdump: Buffer over-read in print-rsvp.c:rsvp_obj_print() in RSVP parser

The RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvpobjprint...

Apache Syncope Remote Code Execution Vulnerability

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A security vulnerability exists in Apache Syncope versions 1.2.x...

CVE-2018-1219

EMC RSA Archer, versions prior to 6.2.0.8, contains an improper access control vulnerability on an API which is used to enumerate user information. A remote authenticated malicious user can potentially exploit this vulnerability to gather information about the user base and may use this informati...

CVE-2017-15351

The 'Find Phone' function in Huawei Honor V9 play smart phones with versions earlier than Jimmy-AL00AC00B135 has an authentication bypass vulnerability. Due to improper authentication realization in the 'Find Phone' function. An attacker may exploit the vulnerability to bypass the 'Find Phone'...

JQuery 1.x < 1.12.0 / 2.x < 2.2.0 XSS

The version of JQuery library hosted on the remote web server is 1.x prior to 1.12.0 or 2.x prior to 2.2.0. It is, therefore, affected by a cross site scripting vulnerability when using location.host to select elements. C Tenable Network Security, Inc. include"compat.inc"; if description...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2018-02263)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in the previous version of Mozilla Firefox 58. An attacker could exploit the vulnerability to obtain sensitive information...

UBUNTU-CVE-2018-5116

WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions can inject frames from arbitrary origins into the loaded page and then interact with them, bypassing same-origin user expectations with th...

CVE-2018-2690

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBo...

[SECURITY] Fedora 27 Update: python33-3.3.7-2.fc27

Python 3.3 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.3, see other distributions that support it, such as CentOS or RHEL with Software...

Null pointer dereference

ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore component and might lead to denial of service...

[SECURITY] Fedora 26 Update: python35-3.5.4-2.fc26

Python 3.5 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.5, see other distributions that support it, such as CentOS or RHEL with Software...

AZL-6823 CVE-2017-17522 affecting package python2 for versions less than 2.7.18-8

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is...

CVE-2017-8136

HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target device to cause information leak...

UBUNTU-CVE-2015-6748

Cross-site scripting XSS vulnerability in jsoup before 1.8.3...

EE 4GEE WiFi MBB Cross-Site Request Forgery Vulnerability (CNVD-2017-33216)

The EE 4GEE WiFi MBB is a mobile wireless router device from EE UK. A cross-site request forgery vulnerability exists in versions prior to EE 4GEE WiFi MBB EE600005.0031. A remote attacker can exploit this vulnerability to perform unauthorized operations by tricking a user into visiting a malicio...

PT-2017-3941 · Red Hat +1 · 389-Ds-Base +2

Name of the Vulnerable Software and Affected Versions: 389-ds-base versions prior to 1.3.5.19 and 1.3.6.7 Description: The issue is related to an account lockout error in the 389 Directory Server, which could allow password guessing. Exploitation of this issue may enable a remote attacker to acce...

UBUNTU-CVE-2017-7808

A content security policy CSP "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. This results in a cross-origin information leak of this path information. This vulnerability affects Firefox 55...

Trello app for iOS cross-site scripting vulnerability

Trello app for iOS is a free iOS-based project management tool developed by the American company Trello. The product features high flexibility and a visual interface. A cross-site scripting vulnerability exists in versions of Trello app prior to 4.0.8 for iOS-based platforms. A remote attacker ca...

WakaTime: SSH backdated version open port

You are running a version of OpenSSH which is older than 6.7 Versions prior than 6.7 are vulnerable to an off by one error that allows local users to gain root access, and it may be possible for remote users to similarly compromise the daemon for remote access. In addition, a vulnerable SSH clien...