IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-21187)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9. A local attacker could exploit the vulnerability to read user credentials...

PT-2018-1746 · D Link · Dwr-116 +7

Name of the Vulnerable Software and Affected Versions: D-Link DWR-116 versions 1.06 and earlier D-Link DIR-140L versions 1.02 and earlier D-Link DIR-640L versions 1.02 and earlier D-Link DWR-512 versions 2.02 and earlier D-Link DWR-712 versions 2.02 and earlier D-Link DWR-912 versions 2.02 and...

[SECURITY] Fedora 27 Update: liblouis-2.6.2-13.fc27

Liblouis is an open-source braille translator and back-translator named in honor of Louis Braille. It features support for computer and literary brail le, supports contracted and uncontracted translation for many languages and has support for hyphenation. New languages can easily be added through...

CVE-2018-1723

IBM Spectrum Scale 4.1.1.0, 4.1.1.20, 4.2.0.0, 4.2.3.10, 5.0.0 and 5.0.1.2 could allow an unprivileged, authenticated user with access to a GPFS node to read arbitrary files available on this node. IBM X-Force ID: 147373...

CVE-2018-17983

cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry...

CVE-2018-12471 External Entity processing in the RegistrationSharing module

A External Entity Reference 'XXE' vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37...

Brave Software: RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context

Summary: \395737 has shown that Brave supports chrome://brave/ URLs. The Brave team introduced a patch which blocks navigation to chrome://brave and removed chrome.remote.require to prevent command execution on the machine. Navigation to chrome://brave via shortcut files From my understanding: 1...

CVE-2018-16712

IObit Advanced SystemCare, which includes Monitorwin10x64.sys or Monitorwin7x64.sys, 1.2.0.5 and possibly earlier versions allows a user to send a specially crafted IOCTL 0x9C406104 to read physical memory...

Design/Logic Flaw

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific...

CVE-2017-18280

In Snapdragon Automobile, Mobile, Wear in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDM429, SDM439, SDM632, SnapdragonHighMed2016, when a Trusted Application has opened the SPI/I2C...

Arbitrary file reading vulnerability in Laoban CMS backend

Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. There is an arbitrary file reading vulnerability in the background of Laoban CMS. An attacker can exploit the vulnerability to read...

GHSA-6834-R92F-JJ42 Moderate severity vulnerability that affects actionview

Withdrawn, accidental duplicate publish. Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestrict...

CVE-2018-16288

LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...

CVE-2018-16288

Affected product: LG SuperSign EZ CMS 2.5. Vulnerability: Local File Inclusion (LFI) in signEzUI/playlist/edit/upload/..%2f URIs allows reading arbitrary files on the device. The Nuclei template and Open Source disclosures confirm this LFI condition, with paths such as signEzUI/playlist/edit/uplo...

Microsoft SharePoint Enterprise Server Privilege Access Control Vulnerability

Microsoft SharePoint Enterprise Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A...

Fixed in ClickHouse Release 18.12.13, 2018-09-10 

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...

CVE-2018-16658

An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdromioctldrivestatus in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940...

FUJI XEROX DocuCentre-V 3065 Printer - Remote Command Execution

Exploit Title: FUJI XEROX DocuCentre-V 3065 Printer - Remote Command Execution Date: 2018-09-05 Exploit Author: vrsystem Vendor Homepage: https://www.fujixerox.com.cn/ Software Link: https://www.fujixerox.com.cn/ Version: DocuCentre-IV,DocuCentre-VI,DocuCentre-V,ApeosPort-VI,ApeosPort-V Tested on...

Design/Logic Flaw

A flaw was found in the way dicunserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value...

CVE-2018-10923

CVE-2018-10923 affects GlusterFS server. The description in the connected documents shows that the vulnerability arises from the mknod(2) pathway, allowing an authenticated attacker to create device files on a GlusterFS server node and read data from any device attached to the server. This indica...