PT-2019-3709

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.2.0.1, 18c, 19c Description The issue is related to a vulnerability in the Core RDBMS component of Oracle Database Server, which is easily exploitable and allows a low-privileged attacker with Create Session...

PT-2019-3729

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.2.0.1, 18c, 19c Description The issue is related to a vulnerability in the Core RDBMS component of Oracle Database Server, which can be easily exploited by a low-privileged attacker with Create Session...

ALPINE-CVE-2018-20482

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service infinite read loop in sparsedumpregion in sparse.c by modifying a file that is supposed to be archived by a different user's process e.g., a system back...

CVE-2018-20483

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this attribut...

WeBid SQL Injection Vulnerability (CNVD-2019-43415)

WeBid is an open source auction site building solutions. A SQL injection vulnerability exists in the yourauctions.php script in WeBid 1.2.2 and earlier versions. A remote attacker can exploit this vulnerability by sending an HTTP request to read the database...

Facebook Admits Giving Partners Access to Messages

UPDATE Facebook has admitted that it dealt several messaging partnerships with tech giants, giving them read, write and delete access for Facebook messages. The confirmation comes on the heels of a bombshell New York Times article, Tuesday, which leveraged internal documents to show that Facebook...

QEMU Directory Traversal Vulnerability

QEMU is a suite of analog processor software developed by French programmer Fabrice Bellard.Media Transfer Protocol MTP is one of the... There is a security vulnerability in MTP in QEMU. An attacker could use this vulnerability to navigate the host filesystem in the context of a QEMU process and...

CVE-2018-15800

Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage...

PT-2018-13215

Name of the Vulnerable Software and Affected Versions Cloud Foundry Bits Service versions prior to 2.18.0 Description The issue allows a remote malicious user to execute a timing attack, potentially brute-forcing the signing key. This could grant the attacker complete read and write access to the...

IBM Cloud Private Information Disclosure Vulnerability

IBM Cloud Private is a set of enterprise private cloud solutions from IBM USA. The product is built primarily on Kubernetes and container technology. An information disclosure vulnerability exists in IBM Cloud Private version 2.1.0, which originates from a program that sets the CA Private Key to ...

CVE-2018-19342

The u3d plugin 9.3.0.10809 aka plugins\U3DBrowser.fpi in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service out-of-bounds read or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at...

PT-2018-14925

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.3.0.10826 Description The issue allows remote attackers to cause a denial of service or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL" issue. This is due to a problem in the...

PT-2018-14926

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.3.0.10826 Description The issue allows remote attackers to cause a denial of service or obtain sensitive information via a U3D sample. This is due to a "Read Access Violation" issue in the u3d plugin. Recommendations For...

PT-2018-14929

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.3.0.10826 Description The issue allows remote attackers to cause a denial of service or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL" issue. This is due to a problem in the...

Code injection

Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service storage...

CVE-2018-15796

Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service storage...

CVE-2018-15444 Cisco Energy Management Suite XML External Entity Vulnerability

A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entri...

OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

PT-2018-1859

Name of the Vulnerable Software and Affected Versions Cisco Energy Management Suite Software affected versions not specified Description The issue is related to the improper handling of XML External Entity XXE entries when parsing certain XML files in the web-based user interface. This could allo...

CVE-2018-15796: Signing Key Extraction in Bits Service | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using bits-service-release versions prior to 2.14.0 Description Cloud Foundry Bits Service, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may...