CVE-2018-13252

Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page...

CVE-2018-12576: Improper Restriction of Rendered UI Layers or Frames

TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking...

Authentication flaw

Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials...

CVE-2018-12984

Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials...

CVE-2018-12889: Out-of-bounds Write

An issue was discovered in CCN-lite 2.0.1. There is a heap-based buffer overflow in mkAddToRelayCacheRequest and in ccnlpopulatecache for an array lacking '\0' termination when reading a binary CCNx or NDN file. This can result in Heap Corruption. This was addressed by fixing the memory managemen...

PT-2018-3772

Name of the Vulnerable Software and Affected Versions beep version 1.3 and up Description The issue is related to an External Control of File Name or Path vulnerability in the --device option of the beep utility. This can result in a Local Denial of Service DoS attack, where an unprivileged user...

CVE-2018-1000532: Improper Limitation of a Pathname to a Restricted Directory

beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibit execution of arbitrary programs by other users, allowing DoS. This attack appear to be exploitable via The system must allow local users...

PT-2018-18394

Name of the Vulnerable Software and Affected Versions: Apache Qpid Broker-J versions 7.0.0 through 7.0.4 Apache Qpid Broker-J versions prior to 7.1.0 Description: A Denial of Service issue was found when using AMQP protocols 0-8, 0-9, or 0-91 to publish messages with a size greater than the allow...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM XIV Gen2 (CVE-2016-0777, CVE-2016-0778)

Summary An information leak flaw and buffer overflow flaw in the way the OpenSSH client roaming feature was implemented affects IBM XIV Gen2. Vulnerability Details CVEID: CVE-2016-0777 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by a client informati...

Microsoft Windows: User Account Control: Detect application installations and prompt for elevation

This policy setting determines the behavior of application installation detection for the entire system. Some software might attempt to install itself after being given permission to run. The user may give permission for the program to run because the program is trusted. Then the user is prompted...

GHSA-VWRF-R5R4-7775 Incorrect handling of CORS preflight request headers in hapi

Versions of hapi prior to 11.0.0 implement CORS incorrectly, allowing for configurations that at best return inconsistent headers, and at worst allow cross-origin activities that are expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, t...

Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low skill level to exploit Vendor: Rockwell Automation Equipment: RSLinx Classic and FactoryTalk Linx Gateway Vulnerability: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authorized, but...

Canon MF210/MF220 Series Printers Access Bypass Vulnerability (Apr 2018)

Canon MF210/MF220 Series Printers are prone to an access bypass vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...

PT-2018-10715

Name of the Vulnerable Software and Affected Versions Rondaful M1 Wristband Smart Band version 1 Description The issue allows remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic. Recommendations For Rondaful M1 Wristband Smart Ban...

Appnitro MachForm < 4.2.3 Multiple Vulnerabilities

Appnitro MachForm is prone to multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

Mozilla: Encrypted mail leaks plaintext through src attribute

Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR 52.8 and Thunderbird 52.8...

PT-2018-9986

Name of the Vulnerable Software and Affected Versions: ReadA versions 1.1.0.2 and previous Description: A vulnerability allows an authorized user with access to a privileged account on a BD Kiestra system to issue SQL commands, potentially resulting in loss or corruption of data. Recommendations:...

BD Kiestra and InoquIA Systems (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION : Exploitable from adjacent network Vendor : Becton, Dickinson and Company BD Equipment : BD Kiestra and InoqulA systems Vulnerabilities : Product UI does not Warn User of Unsafe Actions 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

PT-2018-18103

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions V8.2 20170817 and prior Advantech WebAccess versions V8.3.0 and prior Advantech WebAccess Dashboard versions V.2.0.15 and prior Advantech WebAccess Scada Node versions prior to 8.3.1 Advantech WebAccess/NMS version...

PT-2018-4106

Name of the Vulnerable Software and Affected Versions Android versions 4.1.1 through 4.4.2 Description The issue allows attackers to bypass intended access restrictions in the NotificationBroadcastReceiver class, enabling them to make phone calls to arbitrary numbers, send mmi or ussd codes, or...