PT-2018-10145

Name of the Vulnerable Software and Affected Versions git-annex affected versions not specified Description The issue concerns a private data exposure and exfiltration attack in git-annex. It could expose the content of files located outside the git-annex repository or content from a private web...

PT-2018-11608 · Aqua Security +2 · Tcpreplay +2

Name of the Vulnerable Software and Affected Versions: Tcpreplay version 4.3.0 beta1 Description: The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via crafted packets. This can be demonstrated using tcpprep...

PT-2018-3897 · Oracle +1 · Mysql Server

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 8.0.11 and prior Description: The issue is related to inadequate access control in the Server: Replication component of Oracle MySQL Server. This can be exploited by a remote attacker to cause a denial of service...

PT-2018-16141 · Node.Js · Connect

Name of the Vulnerable Software and Affected Versions: connect node module versions prior to 2.14.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability due to a lack of validation of a file in the directory.js middleware. This allows for potential exploitation. No...

PT-2018-5368 · Moxa · Moxa Edr-810

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 version 4.1 build 17030317 Description: A password storage issue exists in the operating system functionality, allowing an attacker with shell access to extract passwords in clear text from the device. Recommendations: For Moxa...

PT-2018-1311

Name of the Vulnerable Software and Affected Versions Microsoft Windows VBScript Engine versions prior to the fixed version Description A remote code execution issue exists in the way the VBScript engine handles objects in memory. This allows remote attackers to execute arbitrary code and affect...

PT-2018-10049 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.5.2 Description: The issue allows an administrator to inject a Cross Site Scripting XSS payload via the ZC BLOG NAME parameter in the "Web site settings -- Basic setting -- Website title" section, accessible through the zb...

CVE-2014-2552

Brookins Consulting BC Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote attackers to gain access to sensitive data...

PT-2018-9752 · Vaultize · Vaultize Enterprise File Sharing

Name of the Vulnerable Software and Affected Versions: Vaultize Enterprise File Sharing version 17.05.31 Description: An issue was discovered that allows for Stored XSS via the optional message field of a file request. Recommendations: For Vaultize Enterprise File Sharing version 17.05.31, consid...

PT-2018-5655 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 8.3.2.25013 Description: A use-after-free issue in the JavaScript engine of Foxit PDF Reader can be exploited by opening a specially crafted PDF document, allowing arbitrary code execution. This can be triggered by an...

PT-2018-16240 · Nasa · Cfitsio

Name of the Vulnerable Software and Affected Versions: NASA CFITSIO version 3.42 Description: The issue arises from specially crafted images parsed via the library, which can cause a stack-based buffer overflow, overwriting arbitrary data. This can be triggered by delivering an FIT image,...

PT-2018-3913 · D Link · D-Link Dsl-3782

Name of the Vulnerable Software and Affected Versions: D-Link DSL-3782 versions 1.01 Description: The issue is related to a buffer overflow in the /userfs/bin/tcapi binary of the Diagnostics component in the D-Link DSL-3782 router's firmware. This can be exploited by passing a long buffer as the...

PT-2018-10222 · Coreos +3 · Etcd +3

Name of the Vulnerable Software and Affected Versions: etcd versions 3.3.1 and earlier Description: A cross-site request forgery flaw was found, allowing an attacker to set up a website that tries to send a POST request to the etcd server and modify a key. Since adding a key is done with PUT, it ...

How to restrict users to access device settings on Samsung devices in KIOSK mode

Restrict users to access device settings in Samsung KIOSK mode...

PT-2018-3804 · Cisco · Cisco Ios Xe +2

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software affected versions not specified Cisco IOS XE Software affected versions not specified Cisco IOS XR Software affected versions not specified Description: A Format String vulnerability in the Link Layer Discovery Protocol LLD...

PT-2018-5649 · Sdl +2 · Sdl2 Image +2

Name of the Vulnerable Software and Affected Versions: SDL2 image version 2.0.2 Description: A code execution issue exists in the XCF image rendering functionality. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can trigger this issue by displayi...

PT-2018-17534

Name of the Vulnerable Software and Affected Versions Kingsoft WPS Office Free version 10.2.0.5978 Description The issue allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of .pipeWPSCloudSvrWpsCloudSvr, which is described as an...

Multiple vulnerabilities in CG-WGR1200

Overview CG-WGR1200 provided by Corega Inc is a wireless LAN router. CG-WGR1200 contains multiple vulnerabilities listed below. Buffer Overflow CWE-119 - CVE-2017-10852 Buffer Overflow CWE-78 - CVE-2017-10853 Authentication bypass CWE-306 - CVE-2017-10854 Taizoh Tsukamoto of Mitsui Bussan Secure...

PT-2018-3026 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.15.8 Description: The issue is related to the fd locked ioctl function in the Linux kernel, specifically in the floppy driver. It allows an attacker to obtain a kernel pointer by sending the FDGETPRM ioctl,...

PT-2018-1126 · Oracle +1 · Java +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Access Control System versions prior to 5.8 patch 9 Description: A vulnerability in Java deserialization used by the affected software could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected...