PT-2018-15512 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extended Application Services version 1.0 Description: The issue allows an unauthenticated user to determine if a given username is valid by analyzing error messages from a specific endpoint. Recommendations: For SAP HANA Extended...

Oracle Financial Services Analytical Applications 7.3.5.x / 8.0.x XXE Injection(CVE-2018-2660) / XSS(CVE-2018-2661)

Vendor description: ------------------- "Oracle is the unchallenged leader in Financial Services, with an integrated, best-in-class, end-to-end solution of intelligent software and powerful hardware designed to meet every financial service need." Source:...

PT-2018-5783 · Ibm · Ibm Doors Web Access

Name of the Vulnerable Software and Affected Versions: IBM Doors Web Access versions 9.5 through 9.6 Description: The issue allows an authenticated user to obtain sensitive information from HTTP internal server error responses. Recommendations: For IBM Doors Web Access versions 9.5 through 9.6,...

PT-2018-17141 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 2017 Plus SP1 17.1.1 Description: An issue was discovered in the legacy .ASP pages of Ipswitch WhatsUp Gold, where multiple SQL injection vulnerabilities are present. These vulnerabilities could allow...

PT-2018-3810 · Gnu +5 · Gnu Libcdio +5

Name of the Vulnerable Software and Affected Versions: GNU libcdio versions prior to 1.0.0 Description: The issue is related to the realloc symlink function in rock.c and is associated with pointer dereference errors. It can be exploited by remote attackers to cause a denial of service...

PT-2018-4008 · D Link · Dir-860L +2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L versions DIR868LA1 FW112b04 and earlier D-Link DIR-865L versions DIR-865L REVA FIRMWARE PATCH 1.08.B01 and earlier D-Link DIR-860L versions DIR860LA1 FW110b04 and earlier Description: The issue allows remote attackers to read ...

PT-2018-16860 · Malwarebytes · Malwarebytes Premium

Name of the Vulnerable Software and Affected Versions: Malwarebytes Premium version 3.3.1.2183 Description: The issue allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e02c in the driver file...

CVE-2017-1191

An undisclosed vulnerability in CLM applications including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0 with potential for failure to restrict URL Access. IBM X-Force ID: 123661...

U.S. Dept Of Defense: WebLogic Server Side Request Forgery

Universal Description Discovery and Integration UDDI application is publicly available on this WebLogic server. The SearchPublicRegistries.jsp page can be abused by unauthenticated attackers to cause the WebLogic web server to connect to an arbitrary TCP port of an arbitrary host. Responses...

PT-2017-15082 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is related to the id parameter in the comm/multiprix.php file. Recommendations: For version 6.0.4, consider...

Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass

Title: Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL Access Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware releases befo...

CVE-2017-15708

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

PT-2017-14610

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.7.1 Description An issue was discovered in the ioqueue component of Teluu pjproject pjlib and pjlib-util in PJSIP. The ioqueue component may issue a double key unregistration after an attacker initiates a socket...

PT-2017-16160 · Blackberry · Qnx Sdp

Name of the Vulnerable Software and Affected Versions: BlackBerry QNX Software Development Platform SDP version 6.6.0 Description: The issue is related to an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled. This could allow an attacker to access...

PT-2017-4257 · Ruby +4 · Yajl-Ruby +4

Name of the Vulnerable Software and Affected Versions: yajl-ruby gem version 1.3.0 Description: The issue is related to insufficient processing of a format string in the yajl string decode function of the yajl encode.c component in the YAJL-ruby JSON library. When a crafted JSON file is supplied ...

PT-2017-3948

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.2m OpenSSL versions prior to 1.1.0g Description The issue is related to a carry propagating bug in the x86 64 Montgomery squaring procedure. This bug may allow a remote attacker to gain unauthorized access to...

PT-2017-14034 · E Sic · E-Sic

Name of the Vulnerable Software and Affected Versions: E-Sic version 1.0 Description: A SQL Injection issue exists in the password reset parameter, specifically the cpfcnpj parameter to the "/reset" URI. Recommendations: For E-Sic version 1.0, avoid using the cpfcnpj parameter in the /reset URI...

PT-2017-4232 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOS versions prior to Stable 6.38.5 Mikrotik RouterOS versions prior to Long-term 6.37.5 Description: The issue is related to memory corruption in the Mikrotik RouterOS web server. A remote and unauthenticated user can trigger t...

PT-2017-3586 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.13.6 Description: A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can...

ProcessMaker Enterprise Core Code Execution Vulnerability(CVE-2016-9045)

Summary A code execution vulnerability exists in ProcessMarker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability. Tested...