PT-2018-16320 · Yi · Yi Home Camera

Name of the Vulnerable Software and Affected Versions: Yi Home Camera version 1.8.7.0D Description: An exploitable code execution issue exists in the firmware update functionality. A specially crafted set of UDP packets can cause a settings change, resulting in denial of service. An attacker can...

PT-2018-12645 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions through 4.1.4 Description: The issue allows a remote attacker with access to mount volumes to exploit the GF XATTROP ENTRY IN KEY xattrop, creating arbitrary, empty files on the target server via abuse of the...

PT-2018-16350 · Sophos · Sophos Hitmanpro.Alert

Name of the Vulnerable Software and Affected Versions: Sophos HitmanPro.Alert version 3.7.6.744 Description: A memory disclosure issue exists in the 0x222000 IOCTL handler functionality. This can be triggered by a specially crafted IRP request, causing the driver to return uninitialized memory an...

BlueStacks App Player fails to restrict access permissions

Overview BlueStacks App Player fails to restrict access permissions CWE-284. Masaki Kubo and Yoshiki Mori of Cybersecurity Laboratory, National Institute of Information and Communications Technology reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

PT-2018-14475 · WordPress · Wp-Live-Chat-Support

Name of the Vulnerable Software and Affected Versions: wp-live-chat-support version 8.0.15 Description: A security issue exists in the wp-live-chat-support plugin for WordPress. The problem is related to the term parameter in the "modules/gdpr.php" file. This issue can be exploited through a...

Microsoft Office: Never allow users to specify groups when restricting permission for documents

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officeneverallowdls.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Document Info Beaconing UI Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

PT-2018-2950

Name of the Vulnerable Software and Affected Versions Paramiko versions 1.17.6 through 2.4.1 Description The issue is related to insufficient access control in the Paramiko library, which can be exploited by a remote attacker to execute arbitrary code using the SSH protocol. This can result in...

Microsoft Office: Restrict File Download

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officerestrictfiledownload.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Restrict File Download Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is fre...

PT-2018-3883 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: An issue exists due to the lack of neutralization of special elements used in the command string construction within the handler function of the "/goform/sylogapply" route. This could lead to...

PT-2018-11065 · Amd · Adrenalin

Name of the Vulnerable Software and Affected Versions: Adrenalin version 5.4.0 Description: A Reflected Cross Site Scripting issue was discovered. The user-supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the "flexiportal/GeneralInfo.aspx" endpoint,...

PT-2018-13565 · Yfcmf · Yfcmf

Name of the Vulnerable Software and Affected Versions: YFCMF version 3.0 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, enabling an attacker to add an administrator account through the admin/admin/adminsave.html endpoint. Recommendations: For YFCMF version 3.0, conside...

R 3.4.4 - Buffer Overflow (SEH)

-------------------------------------------------------- Exploit Title: R v3.4.4 - SEH Buffer Overflow Exploit Exploit Author : ZwX Exploit Date: 2018-08-22 Vendor Homepage : https://www.r-project.org/ Tested on OS: Windows 7 Social: twitter.com/ZwX2a contact: [email protected] Website:...

PT-2018-13245 · Xkbcommon +4 · Xkbcommon +4

Name of the Vulnerable Software and Affected Versions: xkbcommon versions prior to 0.8.1 Description: The issue arises from unchecked NULL pointer usage in the xkbcommon parser, which can be exploited by local attackers to cause a crash due to a NULL pointer dereference. This can occur when a...

PT-2018-16311 · Sqlite Consortium +1 · Sqlite +1

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250 version 0.20.17 Description: A stack-based buffer overflow issue exists in the video-core's HTTP server due to insecure extraction of database fields from the "clips" table of its SQLite database. This can ...

PT-2018-1519 · Containous · Traefik

Name of the Vulnerable Software and Affected Versions: Containous Traefik versions 1.6.x through 1.6.5 Description: The issue is related to errors in the implementation of the API in the Containous Traefik reverse proxy server. If the --api option is used and authentication is missing, the...

PT-2018-3889 · D Link · D-Link Dir-601

Name of the Vulnerable Software and Affected Versions: D-Link DIR-601 version 2.02NA Description: An issue allows an attacker with low privilege "User" account access to intercept the response from a POST request and obtain "Admin" rights due to the admin password being displayed in XML. The...

PT-2018-6273 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: An attacker could send an authenticated HTTP request to trigger this issue in Insteon Hub. The value for the s url key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large, an...

PT-2018-10495 · Intuit · Intuit Lacerte

Name of the Vulnerable Software and Affected Versions: Intuit Lacerte version 2017 Intuit Lacerte versions prior to 2017 Description: The software transfers the entire customer list in cleartext over SMB, allowing attackers to obtain sensitive information by sniffing the network or conduct...

PT-2018-12614 · Thomson Reuters · Thomson Reuters Ultratax Cs

Name of the Vulnerable Software and Affected Versions: Thomson Reuters UltraTax CS version 2017 Description: The software has a password protection option, but the level of protection may not meet some customers' expectations because the data is stored in cleartext. Customer data is stored in...

PT-2018-3181 · Mutt +7 · Mutt +7

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.10.1 NeoMutt versions prior to 2018-07-16 Description: The issue is related to errors in handling references to the ".." directory in mailbox names in the imap/util.c component of Mutt and NeoMutt email clients. This...