CVE-2018-1000411: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result...

Fedora 28 : 1:epiphany (2018-a5e45fc9f7)

Fix CVE-2018-11396/CVE-2018-12016 795740 - Allow Ctrl+T in app mode again due to unintended consequences 796204 - Don't remember passwords when the setting is disabled 796219 - Fix password manager crash on chase.com GitLab 11 Note that Tenable Network Security has extracted the preceding...

Design/Logic Flaw

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

CVE-2018-18959

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

CVE-2018-18959

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

CVE-2018-18959

The CVE-2018-18959 issue affects Epson WorkForce WF-2861 devices (10.48 LQ22I3, 10.51.LQ20I6, 10.52.LQ17IA). On the Air Print Setting page, if the data for Bonjour Service Location at /PRESENTATION/BONJOUR exceeds 251 bytes during data submission, the device becomes unusable until a reboot. This ...

PT-2018-15375 · Telegram · Telegram

Name of the Vulnerable Software and Affected Versions: Telegram version 4.9.1 Telegram Web-version 0.7.0 Description: The issue concerns a side channel in the "secret chat" feature where Telegram servers send GET requests for URLs typed while composing a chat message, before the message is sent...

PT-2018-14743

Name of the Vulnerable Software and Affected Versions Epson WorkForce WF-2861 versions 10.48 LQ22I3, 10.51.LQ20I6, 10.52.LQ17IA Description An issue was discovered where the device no longer functions until a reboot when the data for 'Bonjour Service Location' at the "/PRESENTATION/BONJOUR" API...

CVE-2018-18959: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

Moxa NPort W2x50A Operating System Command Injection Vulnerability

Moxa NPort W2x50A is a Moxa serial communication server for connecting industrial serial devices to a network. An operating system command injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware prior to version 2.2 Build18082311. An attacker can...

PT-2018-15031 · Hashicorp +1 · Hashicorp Consul +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul versions 0.5.1 through 1.4.0 Description: The issue arises from the improper documentation of the verify outgoing setting, allowing HashiCorp Consul to use cleartext agent-to-agent RPC communication. This affects versions 0.5...

Design/Logic Flaw

Inappropriate setting of the SEEMASKFLAGNOUI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page...

CVE-2018-19693

An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...

Intel DCI Policy Update - US

Lenovo Security Advisory: LEN-23611 Potential Impact: Privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2018-3652 Summary Description: Intel is releasing Direct Connect Interface DCI policy update. Existing UEFI setting restrictions for...

CVE-2018-19530

HTTL aka Hyper-Text Template Language through 1.0.11 allows remote command execution because the decodeXml function uses XStream unsafely when configured with an xml.codec=httl.spi.codecs.XstreamCodec setting...

CVE-2018-19531

HTTL aka Hyper-Text Template Language through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEncoder unsafely when configured without an xml.codec= setting...

CVE-2018-19464

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

Cloned Nimble volumes are not visible

Challenge By default, cloned Nimble Volumes are not shown in Veeam Backup and Replication UI and cannot be interacted with. However you can implement registry setting that will enable Nimble cloned volumes for interaction. Solution 1. Create the following registry value on the Veeam Backup and...

JPress Cross-Site Scripting Vulnerability

JPress is a set of blogging platform developed using the Java language. A cross-site scripting vulnerability exists in JPress version 1.0-rc.5, which can be exploited to inject arbitrary web script or HTML by sending the site name, site title, or site subtitle fields to the...

CVE-2018-19170: Improper Neutralization of Input During Web Page Generation

In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...