PT-2018-13565 · Yfcmf · Yfcmf

Name of the Vulnerable Software and Affected Versions: YFCMF version 3.0 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, enabling an attacker to add an administrator account through the admin/admin/adminsave.html endpoint. Recommendations: For YFCMF version 3.0, conside...

PT-2018-16311 · Sqlite Consortium +1 · Sqlite +1

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250 version 0.20.17 Description: A stack-based buffer overflow issue exists in the video-core's HTTP server due to insecure extraction of database fields from the "clips" table of its SQLite database. This can ...

PT-2018-6273 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: An attacker could send an authenticated HTTP request to trigger this issue in Insteon Hub. The value for the s url key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large, an...

PT-2018-10495 · Intuit · Intuit Lacerte

Name of the Vulnerable Software and Affected Versions: Intuit Lacerte version 2017 Intuit Lacerte versions prior to 2017 Description: The software transfers the entire customer list in cleartext over SMB, allowing attackers to obtain sensitive information by sniffing the network or conduct...

PT-2018-12614 · Thomson Reuters · Thomson Reuters Ultratax Cs

Name of the Vulnerable Software and Affected Versions: Thomson Reuters UltraTax CS version 2017 Description: The software has a password protection option, but the level of protection may not meet some customers' expectations because the data is stored in cleartext. Customer data is stored in...

PT-2018-11608 · Aqua Security +2 · Tcpreplay +2

Name of the Vulnerable Software and Affected Versions: Tcpreplay version 4.3.0 beta1 Description: The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via crafted packets. This can be demonstrated using tcpprep...

PT-2018-16141 · Node.Js · Connect

Name of the Vulnerable Software and Affected Versions: connect node module versions prior to 2.14.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability due to a lack of validation of a file in the directory.js middleware. This allows for potential exploitation. No...

PT-2018-10049 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.5.2 Description: The issue allows an administrator to inject a Cross Site Scripting XSS payload via the ZC BLOG NAME parameter in the "Web site settings -- Basic setting -- Website title" section, accessible through the zb...

CVE-2014-2552

Brookins Consulting BC Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote attackers to gain access to sensitive data...

PT-2018-16240 · Nasa · Cfitsio

Name of the Vulnerable Software and Affected Versions: NASA CFITSIO version 3.42 Description: The issue arises from specially crafted images parsed via the library, which can cause a stack-based buffer overflow, overwriting arbitrary data. This can be triggered by delivering an FIT image,...

PT-2018-3913 · D Link · D-Link Dsl-3782

Name of the Vulnerable Software and Affected Versions: D-Link DSL-3782 versions 1.01 Description: The issue is related to a buffer overflow in the /userfs/bin/tcapi binary of the Diagnostics component in the D-Link DSL-3782 router's firmware. This can be exploited by passing a long buffer as the...

PT-2018-10222 · Coreos +3 · Etcd +3

Name of the Vulnerable Software and Affected Versions: etcd versions 3.3.1 and earlier Description: A cross-site request forgery flaw was found, allowing an attacker to set up a website that tries to send a POST request to the etcd server and modify a key. Since adding a key is done with PUT, it ...

How to restrict users to access device settings on Samsung devices in KIOSK mode

Restrict users to access device settings in Samsung KIOSK mode...

PT-2018-3804 · Cisco · Cisco Ios Xe +2

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software affected versions not specified Cisco IOS XE Software affected versions not specified Cisco IOS XR Software affected versions not specified Description: A Format String vulnerability in the Link Layer Discovery Protocol LLD...

PT-2018-17534

Name of the Vulnerable Software and Affected Versions Kingsoft WPS Office Free version 10.2.0.5978 Description The issue allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of .pipeWPSCloudSvrWpsCloudSvr, which is described as an...

PT-2018-1126 · Oracle +1 · Java +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Access Control System versions prior to 5.8 patch 9 Description: A vulnerability in Java deserialization used by the affected software could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected...

PT-2018-3026 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.15.8 Description: The issue is related to the fd locked ioctl function in the Linux kernel, specifically in the floppy driver. It allows an attacker to obtain a kernel pointer by sending the FDGETPRM ioctl,...

PT-2018-15512 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extended Application Services version 1.0 Description: The issue allows an unauthenticated user to determine if a given username is valid by analyzing error messages from a specific endpoint. Recommendations: For SAP HANA Extended...

PT-2018-5783 · Ibm · Ibm Doors Web Access

Name of the Vulnerable Software and Affected Versions: IBM Doors Web Access versions 9.5 through 9.6 Description: The issue allows an authenticated user to obtain sensitive information from HTTP internal server error responses. Recommendations: For IBM Doors Web Access versions 9.5 through 9.6,...

PT-2018-17141 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 2017 Plus SP1 17.1.1 Description: An issue was discovered in the legacy .ASP pages of Ipswitch WhatsUp Gold, where multiple SQL injection vulnerabilities are present. These vulnerabilities could allow...