CVE-2018-2933

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP t...

SUSE-SU-2018:2172-1 Security update for cups

This update for cups fixes the following issues: The following security vulnerabilities were fixed: - Fixed a local privilege escalation to root and sandbox bypasses in the scheduler - CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend bsc1096405 - CVE-2018-4181: Limited...

Security Bulletin: Arbitrary File Reads (CVE-2018-1705) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Arbitrary File Reads CVE-2018-1705 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1705 DESCRIPTION: IBM Platform Symphony contains an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive...

CVE-2018-3019

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications subcomponent: Infrastructure. Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0, 12.4.0, 14.0.0 and 14.1.0. Easily exploitable...

CVE-2018-2920

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: API frameworks. The supported version that is affected is Prior to 8.7.19. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols ...

CVE-2018-2896

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications subcomponent: Payments Core. Supported versions that are affected are 12.2.0, 12.3.0, 12.4.0, 12.5.0 and 14.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access vi...

CVE-2018-2897

Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications subcomponent: Infrastructure. Supported versions that are affected are 12.3.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows unauthenticated attacker...

IBM InfoSphere Data Replication Dashboard Path Traversal Vulnerability

IBM InfoSphere Data Replication Dashboard is a data synchronization solution from IBM USA. The solution enables log-based data change capture through real-time replication and provides features such as trusted data integration and synchronization. A directory traversal vulnerability exists in IBM...

Debian DLA-1426-1 : cups security update

Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids : CVE-2018-4180 Dan Bastone of Gotham Digital Science discovered that a local attacker with access to cupsctl could escalate privileges by setting an...

openssl: certificate message OOB reads

Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL...

openssl: certificate message OOB reads

Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL...

Microsoft Edge Chakra JIT - Out-of-Bounds Reads/Writes

/ It seems that this issue is similar to the issue 1429 MSRC 42111. It might need to refresh the page several times to observe a crash. PoC: / let arr = new Uint32Array1000; for let i = 0; i 0x1000000; i++ for let j = 0; j 1; j++ i--; i++; arri = 0x1234;...

Debian DSA-4243-1 : cups - security update

Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids : - CVE-2017-15400 Rory McNamara discovered that an attacker is able to execute arbitrary commands with the privilege of the CUPS daemon by setting a...

FreeBSD : Libgit2 -- multiple vulnerabilities (3c9b7698-84da-11e8-8c75-d8cb8abf62dd)

The Git community reports : Out-of-bounds reads when reading objects from a packfile C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use...

hw: cpu: speculative store bypass

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions a commonly used performance optimization. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the...

[SECURITY] [DSA 4243-1] cups security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4243-1 [email protected] https://www.debian.org/security/ Luciano Bello July 11, 2018 https://www.debian.org/security/faq -...

Microsoft SharePoint Elevation of Privilege Vulnerability (CNVD-2018-13385)

Microsoft SharePoint Enterprise Server 2013 SP1 and SharePoint Enterprise Server 2016 are both enterprise business collaboration platforms from Microsoft Corporation USA. The platforms are used to consolidate business information and enable sharing of work, collaborating with others, organizing...

Memory Corruption Vulnerability in TAS AP-PCLINK setup V1.5

The AP series is a new generation of programmable controllers PLCs newly developed by TSMC. A memory corruption vulnerability exists in AP-PCLINK setup V1.5 of TAS. The vulnerability is caused due to AP-PCLINK failing to validate the availability of a pointer to a function when reading a malforme...

Ubuntu 14.04 LTS : AMD Microcode regression (USN-3690-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3690-2 advisory. USN-3690-1 provided updated microcode for AMD processors to address CVE-2017-5715 aka Spectre. Unfortunately, the update caused some systems to fail to boot. This...

Remote Code Execution (RCE)

microsoft.chakracore is vulnerable to remote code execution. This happens because the SetupLocalVariables function in AsmJsModule.cpp fails to check whether a variable was previously used in the initializer, leading to out-of-bound reads which can allow an attacker to perform RCE. This CVE ID is...