CVE-2018-4979

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Security Bypass vulnerability. Successful exploitation could lead to information disclosure...

CVE-2018-4995

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an XFA '\n' POST injection vulnerability. Successful exploitation could lead to a security bypass...

KLA11292 Multiple vulnerabilities in Apple iTunes

Multiple serious vulnerabilities have been found in Apple iTunes. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code and bypass security restrictions. Below is a complete list of vulnerabilities: 1. An unknown...

Eclipse Jetty Server Fake Pipeline Request Security Bypass Vulnerability - Windows

Eclipse Jetty Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty";...

Eclipse Jetty Server Fake Pipeline Request Security Bypass Vulnerability - Linux

Eclipse Jetty Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty";...

ECOS Secure Boot Stick Authentication Bypass Vulnerability

The ECOS Secure Boot Stick a.k.a. SBS is a security device from ECOS TECHNOLOGY, Germany for remote access to Citrix, Microsoft Terminal Server, VMware and other web applications. A security vulnerability exists in ECOS SBS version 5.6.5. An attacker could exploit the vulnerability to bypass...

Oracle Solaris Remote Shell Code Execution (CVE-2017-3623) - Ver2

A security bypass vulnerability has been reported in Oracle Solaris. The vulnerability is due to an error in the way the server validates RPC requests from unauthorized users. A remote attacker can exploit this issue by sending specially crafted RPC requests to the target. Successful exploitation...

Xen Local Security Bypass Vulnerability (CNVD-2018-15165)

Xen is an open source virtual machine monitor, developed by the University of Cambridge. It is intended to run up to 102 full-featured operating systems on a single computer. A local security bypass vulnerability exists in Xen versions 4.7 through 4.10.x, which stems from a program's failure to...

Apache CXF CVE-2018-8039 TLS Hostname Verification Security Bypass Vulnerability

Description Apache CXF is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to obtain sensitive information by conducting a man-in-the-middle attack. This may lead to other attacks. The following versions of product are vulnerable: Apache CXF 3.1.16...

CVE-2018-0572

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors...

CVE-2018-0567

Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors...

Trend Micro OfficeScan Multiple Vulnerabilities (1119961)

Trend Micro OfficeScan is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PayPal Inc - Security Key Pin Approval & Expire Bypass

Document Title: =============== PayPal Inc - Security Key Pin Approval & Expire Bypass References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1666 Release Date: ============= 2018-06-25 Vulnerability Laboratory ID VL-ID: ==================================== 166...

phpmyadmin4.8.1后台getshell

官网下载的最新版，文件名是phpMyAdmin-4.8.1-all-languages.zip 问题就出现在了 /index.php 找到5563行 第61行出现了 include $REQUEST'target'; 很明显这是LFI的前兆，我们只要绕过5559的限制就行 第57行限制 target 参数不能以index开头 第58行限制 target 参数不能出现在 $targetblacklist 内 找到 $targetblacklist 的定义： 就在 /index.php 的第50行 只要 target 参数不是 import.php 或 export.php...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Flex System Manager (FSM) Storage Manager Install Anywhere (SMIA) configuration tool (CVE-2017-3738, CVE-2017-3737)

Summary Multiple vulnerabilities have been discovered in OpenSSL that was used by IBM FSM SMIA configuration tool commonly known as Network Advisor. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obta...

Security Bulletin: Tomcat apache vulnerability affects IBM Storwize V7000 Unified

Summary Apache Tomcat is used by Storwize V7000 Unified. Storwize V7000 Unified has addressed the applicable CVEs. Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected...

Security Bulletin: Vulnerability in Apache Struts affects IBM System Storage Storwize V7000 Unified (CVE-2014-0094)

Summary There is a ParametersInterceptor security bypass vulnerability in Apache Struts that is used by IBM System Storage Storwize V7000 Unified. Vulnerability Details CVEID: CVE-2014-0094 DESCRIPTION: Apache Struts could allow a remote attacker to bypass security restrictions, caused by an erro...

Security Only update for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 updates for Windows Server 2012 (KB 4099638)

Security Only update for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 updates for Windows Server 2012 KB 4099638 Summary This update resolves a vulnerability in Microsoft .NET Framework that could cause denial of service when .NET Framework and .NET core components process XML...

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 updates for Windows Server 2012 (KB 4099634)

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 updates for Windows Server 2012 KB 4099634 Notice This update is included in the June 2018 Preview of the Quality Rollups for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7 and 4.7.1 for Windows Server...

Security Bulletin: Multiple vulnerabilities in cURL libcURL affect IBM Tivoli Composite Application Manager for Transactions (CVE-2015-3143, CVE-2015-3144 and CVE-2015-3145)

Summary cURL libcURL vulnerabilities were disclosed on April 22, 2015 by the cURL Project. cURL is used by IBM Tivoli Composite Application Manager for Transactions has addressed the applicable CVEs. Vulnerability Details CVE-ID: CVE-2015-3143 DESCRIPTION: libcurl could allow a remote attacker fr...