PT-2018-14941 · Gnome +2 · Gnome Keyring +2

Name of the Vulnerable Software and Affected Versions: GNOME Keyring versions prior to 3.28.2 Description: The issue allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked. This occurs because available D-Bus protection...

CVE-2018-19358: Undefined Security Weakness

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

CVE-2018-14058

Pimcore before 5.3.0 allows SQL Injection via the REST web service API...

CVE-2018-14058: Improper Neutralization of Special Elements used in an SQL Command

Pimcore before 5.3.0 allows SQL Injection via the REST web service API...

PT-2018-12312

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 5.3.0 Description The issue allows SQL Injection via the REST web service API. Recommendations For versions prior to 5.3.0, update to version 5.3.0 or later to resolve the issue...

Security Bulletin: IBM PowerVC is impacted by OpenStack Glance server-side request forgery (CVE-2017-7200)

Summary IBM PowerVC may disclose some sensitive information while creating images with 'copyfrom' feature in the v1 Image Service API. Vulnerability Details CVEID: CVE-2017-7200 DESCRIPTION: OpenStack Glance is vulnerable to server-side request forgery, caused by a flaw in the 'copyfrom' feature ...

CVE-2013-3703: Missing Authorization

The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...

PT-2018-4094

Name of the Vulnerable Software and Affected Versions Open Build Service API versions prior to 2.4.4 Description The issue concerns a missing write permission check in the controller of the Open Build Service API. This allows an authenticated attacker to modify user roles associated with packages...

Double free

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, incorrect error handling could lead to a double fre...

CVE-2015-9165: Double Free

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, incorrect error handling could lead to a double fre...

PT-2018-4499

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level Description The issue is related to incorrect error handling that could lead to a double free in the QTEE file service API. This affects Android on various Qualcomm Snapdragon Mobile an...

CVE-2017-10037

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

Code injection

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

CVE-2017-10037

CVE-2017-10037 is a vulnerability in Oracle Fusion Middleware’s Oracle BI Publisher (Web Service API subcomponent). Affected are BI Publisher versions 11.1.1.7.0 and 11.1.1.9.0. An unauthenticated attacker with network access via HTTP can compromise BI Publisher, potentially enabling unauthorized...

CVE-2017-10037: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

PT-2017-11037

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 11.1.1.7.0 and 11.1.1.9.0 Description The issue affects the Oracle BI Publisher component, specifically the Web Service API subcomponent. It allows an unauthenticated attacker with network access via HTTP to...

Unspecified Vulnerability in Oracle BI Publisher (CNVD-2017-31688)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's business innovation platform for enterprise and cloud environments, which provides middleware, software collections, etc. Oracle BI Publisher formerly known as XML Publisher is one of the reporting component. An unspecified...

CVE-2017-7200

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

CVE-2017-7200

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

CVE-2017-7200

The copyfrom feature in Image Service API v1 allows an attacker to perform masked network port scans. It is possible to create images with a URL such as 'http://localhost:22'. This could allow an attacker to enumerate internal network details while appearing masked, because the scan appears to...