UBUNTU-CVE-2018-19358

DISPUTED GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving th...

CVE-2018-19358

CVE-2018-19358 affects GNOME Keyring up to version 3.28.2, enabling local attackers to retrieve login credentials via Secret Service API calls and the D‑Bus interface when the keyring is unlocked. Root cause cited: failure to apply D‑Bus protection mechanisms (busconfig/policy XML); vendor disput...

CVE-2018-19358

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

CVE-2018-19358

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

PT-2018-14941 · Gnome +2 · Gnome Keyring +2

Name of the Vulnerable Software and Affected Versions: GNOME Keyring versions prior to 3.28.2 Description: The issue allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked. This occurs because available D-Bus protection...

CVE-2018-19358: Undefined Security Weakness

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

CVE-2018-14058

Pimcore before 5.3.0 allows SQL Injection via the REST web service API...

CVE-2018-14058: Improper Neutralization of Special Elements used in an SQL Command

Pimcore before 5.3.0 allows SQL Injection via the REST web service API...

PT-2018-12312

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 5.3.0 Description The issue allows SQL Injection via the REST web service API. Recommendations For versions prior to 5.3.0, update to version 5.3.0 or later to resolve the issue...

Security Bulletin: IBM PowerVC is impacted by OpenStack Glance server-side request forgery (CVE-2017-7200)

Summary IBM PowerVC may disclose some sensitive information while creating images with 'copyfrom' feature in the v1 Image Service API. Vulnerability Details CVEID: CVE-2017-7200 DESCRIPTION: OpenStack Glance is vulnerable to server-side request forgery, caused by a flaw in the 'copyfrom' feature ...

CVE-2013-3703: Missing Authorization

The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...

PT-2018-4094

Name of the Vulnerable Software and Affected Versions Open Build Service API versions prior to 2.4.4 Description The issue concerns a missing write permission check in the controller of the Open Build Service API. This allows an authenticated attacker to modify user roles associated with packages...

Double free

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, incorrect error handling could lead to a double fre...

CVE-2015-9165: Double Free

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, incorrect error handling could lead to a double fre...

PT-2018-4499

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level Description The issue is related to incorrect error handling that could lead to a double free in the QTEE file service API. This affects Android on various Qualcomm Snapdragon Mobile an...

Code injection

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

CVE-2017-10037

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

CVE-2017-10037

CVE-2017-10037 is a vulnerability in Oracle Fusion Middleware’s Oracle BI Publisher (Web Service API subcomponent). Affected are BI Publisher versions 11.1.1.7.0 and 11.1.1.9.0. An unauthenticated attacker with network access via HTTP can compromise BI Publisher, potentially enabling unauthorized...

CVE-2017-10037: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

PT-2017-11037

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 11.1.1.7.0 and 11.1.1.9.0 Description The issue affects the Oracle BI Publisher component, specifically the Web Service API subcomponent. It allows an unauthenticated attacker with network access via HTTP to...