CVE-2018-2774

Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products subcomponent: SQR. Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

KLA11223 Multiple vulnerabilities in Adobe Flash Player

Multiple serious vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to execute arbitrary code and obtain sensitive information. 1. Use-After-Free vulnerability can be exploited remotely to execute arbitrary code; 2. Out-of-bounds reading...

Multiple vulnerabilities in the UCMS system

UCMS is a simple open source content management system. A file read and code execution vulnerability exists in UCMS version 1.4.5. An attacker can exploit the vulnerability to read arbitrary files, execute arbitrary code, and gain server privileges...

Apache Solr XXE Vulnerability (SOLR-11971) - Linux

Apache Solr is prone to a XXE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:solr"; if description...

CVE-2018-9851

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '|' instead of '/' as a directory separator, in conjunction with a ".." sequence...

[SECURITY] Fedora 28 Update: libid3tag-0.15.1b-28.fc28

libid3tag is a library for reading and eventually writing ID3 tags, both ID3v1 and the various versions of ID3v2...

MGASA-2018-0188 Updated squirrelmail packages fix CVE-2018-8741

Updated squirrelmail packages fix security vulnerabilities: Filenames of attachment files are not sanitized, so attackers could read arbitrary files. CVE-2018-8741...

An Android App for RFID Card Cloning: Project Walrus

Walrus is an Android app that simplifies using several existing contactless card cloning devices during red team engagements and physical security assessments. It offers a common interface and database for storing cloned cards. Currently, Walrus supports the industry standard Proxmark 3, Chameleo...

Google Android Qualcomm WLAN Information Disclosure Vulnerability (CNVD-2018-05989)

Android on Google Pixel and Nexus is a Linux-based open source operating system for the Google Pixel and Nexus smartphones developed by Google Inc. and the Open Handset Alliance OHA, with Qualcomm WLAN being one of the components used. Qualcomm WLAN is a wireless LAN component developed by Qualco...

The vulnerability of the Zabbix universal monitoring system arises from incorrect restrictions on XML links to external objects, allowing a perpetrator to execute arbitrary code or read arbitrary files.

The vulnerability of the Zabbix universal monitoring system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or read arbitrary files using a specially crafted XML request...

CVE-2018-1000124

I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in importmetadata.php (line 154) via simplexml_load_string, enabling an attacker to read local files and perform SSRF. Exploitation is described as possible by posting XML in the form_import_textare...

Solaris 10 (sparc) : 119900-16

GNOME 2.6.0: GNOME libtiff - library for reading and writing TIFF. Date this patch was last updated by Sun : Nov/10/12 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Directory Traversal

node-srv is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of sanitization when handling file paths, allowing the ../ payload to be interpreted and reading files out of the server's scope...

Selenium Server Unauthorized Access Vulnerability

Selenium is a tool for web application testing.Selenium tests run directly in the browser, just as a real user would do. Supported browsers include IE 7, 8, 9, 10, 11, Mozilla Firefox, Safari. Google Chrome, Opera, etc. An unauthorized access vulnerability exists in Selenium Server. A malicious...

D-Link DIR Series Cross-Site Scripting Vulnerability (CNVD-2018-06629)

D-Link DIR-868L and others are wireless router products from AUO D-Link. A cross-site scripting vulnerability exists in the htdocs/webinc/body/bscsmssend.php file in the D-Link DIR-868L, DIR-865L, and DIR-860L. A remote attacker can exploit the vulnerability by sending a specially crafted...

D-Link DIR Series Cross-Site Scripting Vulnerability

D-Link DIR-868L and others are wireless router products from AUO D-Link. A cross-site scripting vulnerability exists in the htdocs/webinc/js/bscsmsinbox.php file in the D-Link DIR-868L, DIR-865L, and DIR-860L. A remote attacker can exploit the vulnerability by sending a specially crafted 'Treturn...

Arbitrary File Read Vulnerability in Light CMS Version 1.7

Light CMS is an intelligent website building system built in PHP+MYSQL environment. Light CMS 1.7 version of the arbitrary file reading vulnerability, an attacker can exploit the vulnerability to read any file within the site to obtain sensitive information...

D-Link DIR Series Cross-Site Scripting Vulnerability (CNVD-2018-06630)

The D-Link DIR-868L, DIR-865L and DIR-860L are all wireless router products from AUO D-Link. A cross-site scripting vulnerability exists in the htdocs/webinc/js/advparentctrlmap.php file in the D-Link DIR-868L, DIR-865L, and DIR-860L. A remote attacker can exploit the vulnerability by sending a...

Cross site scripting

XSS vulnerability in htdocs/webinc/js/advparentctrlmap.php in D-Link DIR-868L DIR868LA1FW112b04 and previous versions, DIR-865L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and previous versions allows remote attackers to read a cookie via a crafted...

CVE-2018-6527

XSS vulnerability in htdocs/webinc/js/advparentctrlmap.php in D-Link DIR-868L DIR868LA1FW112b04 and previous versions, DIR-865L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and previous versions allows remote attackers to read a cookie via a crafted...