UBUNTU-CVE-2018-17456

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character...

CVE-2018-0424

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an authenticated, remote attacker to execute arbitrary commands. The vulnerability is due to...

CVE-2018-0424

The CVE-2018-0424 issue affects Cisco RV110W, RV130W, and RV215W routers. It is a command-injection vulnerability in the devices’ web-based management interface caused by improper validation of user-supplied input to scripts. An authenticated, remote attacker could exploit this to execute arbitra...

CVE-2018-12470

A SQL Injection in the RegistrationSharing module of SUSE Linux SMT allows remote attackers to cause execute arbitrary SQL statements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37...

CVE-2018-17408

Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file that is accessed through the Import CSV File menu...

CVE-2018-9452

CVE-2018-9452 affects the Android Framework, tied to getOffsetForHorizontal in Layout.java, causing a possible application hang/DoS from wide inputs with hidden Unicode characters. The issue affects Android 7.0–9.0 and requires user interaction for exploitation; patches were issued for the 2018-1...

Adobe Acrobat and Reader Use After Free (APSB18-30: CVE-2018-15920)

A use-after-free vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

ceph-iscsi-cli: rbd-target-api service runs in debug mode allowing for remote command execution

It was found that rbd-target-api service provided by ceph-iscsi-cli was running in debug mode. An unauthenticated attacker could use this to remotely execute arbitrary code and escalate privileges...

CVE-2018-17827

HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php...

Design/Logic Flaw

Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service use-after-free because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects...

CVE-2018-17611

Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service use-after-free because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects...

CVE-2018-17608

Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service use-after-free because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects...

Article Factory Manager SQL Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A SQL injection vulnerability exists in the Article Factory Manager component of Joomla! The vulnerability is caused by inserting SQL commands into the query string of a web form...

CVE-2018-6043

CVE-2018-6043 affects Google Chrome (Chromium project) via the External Protocol Handler. The root cause is insufficient data validation in the handler, allowing a remote attacker to potentially execute arbitrary code on a user’s machine by presenting a crafted HTML page. Publicly documented impa...

Microsoft Jet Database Engine Remote Code Execution (CVE-2018-8393)

A remote code execution vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Joomla! CWJoomla CW Article Attachments SQL Injection Vulnerability

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other functions.CWJoomla CW Article Attachments is used in which an attachment to add management plug-ins. A SQL injection vulnerability exists...

openSUSE Security Update : hylafax+ (openSUSE-2018-1027)

This update for hylafax+ fixes the following issues : Security issues fixed in 5.6.1 : - CVE-2018-17141: multiple vulnerabilities affecting fax page reception in JPEG format Specially crafted input may have allowed remote execution of arbitrary code boo1109084 Additionally, this update also...

Security update for hylafax+ (critical)

This update for hylafax+ fixes the following issues: Security issues fixed in 5.6.1: - CVE-2018-17141: multiple vulnerabilities affecting fax page reception in JPEG format Specially crafted input may have allowed remote execution of arbitrary code boo1109084 Additionally, this update also contain...

Security update for hylafax+ (critical)

This update for hylafax+ fixes the following issues: Security issues fixed in 5.6.1: - CVE-2018-17141: multiple vulnerabilities affecting fax page reception in JPEG format Specially crafted input may have allowed remote execution of arbitrary code boo1109084 Additionally, this update also contain...

Authentication flaw

An authentication bypass flaw was found in the smartproxydynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context...