CVE-2018-3150

CVE-2018-3150 affects OpenJDK/OpenJDK 11 in Java SE (Utility) deployments when loading untrusted code. The issue relates to jar attribute checks / Multi-Release handling, enabling potential unauthorized data modification with network access under certain conditions. Public advisories (openSUSE/Op...

Oracle Java SE Security Updates-05 (oct2018-4428296) - Windows

Oracle Java SE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:jdk"; ifdescription...

Oracle Java SE Security Updates-05 (oct2018-4428296) - Linux

Oracle Java SE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2018-3150

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Utility. The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this...

openSUSE Security Update : soundtouch (openSUSE-2018-1146)

This update for soundtouch fixes the following security issue : - CVE-2018-1000223: Prevent buffer overflow in WavInFile::readHeaderBlock that could have resulted in arbitrary code execution when opening maliocius file in soundstretch utility bsc1103676 This update was imported from the...

Intel NUC FW kits input validation error vulnerability

Intel NUC FW kits is a mini-desktop from Intel Corporation USA.BIOS update utility is one of the BIOS update utilities. An input validation error vulnerability exists in Intel NUC FW kits. An attacker could exploit this vulnerability to cause a denial of service or information disclosure...

CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

Default configuration

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

CVE-2018-12441

The CorsairService in Corsair Utility Engine has insecure default permissions: the Everyone group is granted SERVICE_ALL_ACCESS, enabling unprivileged local users to modify CorsairService BINARY_PATH_NAME and execute arbitrary commands, resulting in complete control of the system. Connected docum...

CVE-2018-12158

The CVE-2018-12158 issue affects Intel NUC Firmware Kits’ BIOS update utility. Insufficient input validation in the BIOS update executable for kits downloaded before May 24, 2018 could allow a local, privileged user to trigger a denial of service or information disclosure. Affected devices are In...

SUSE-SU-2018:3070-1 Security update for soundtouch

This update for soundtouch fixes the following security issue: - CVE-2018-1000223: Prevent buffer overflow in WavInFile::readHeaderBlock that could have resulted in arbitrary code execution when opening maliocius file in soundstretch utility bsc1103676...

Imperva SecureSphere PWS Command Injection

This module exploits a command injection vulnerability in Imperva SecureSphere 13.x. The vulnerability exists in the PWS service, where Python CGIs didn't properly sanitize user supplied command parameters and directly passes them to corresponding CLI utility, leading to command injection. Agent...

CVE-2018-0433 Cisco SD-WAN Solution Command Injection Vulnerability

A vulnerability in the command-line interface CLI in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability ...

CVE-2018-1783

IBM GPFS IBM Spectrum Scale 4.1.1.0, 4.1.1.20, 4.2.0.0, 4.2.3.10, 5.0.0 and 5.0.1.2 command line utility allows an unprivileged, authenticated user with access to a GPFS node to forcefully terminate GPFS and deny access to data available through GPFS. IBM X-Force ID: 148806...

Intel Extreme Tuning Utility 6.4.1.23 Code Execution / Privilege Escalation Vulnerabilities

Intel Extreme Tuning Utility version 6.4.1.23 suffers from code execution, privilege escalation, and denial of service vulnerabilities. Intel Extreme Tuning Utility 6.4.1.23 Code Execution / Privilege Escalation Hi @ll, the executable installer of the Intel Extreme Tuning Utility, version 6.4.1.2...

Intel Extreme Tuning Utility 6.4.1.23 Code Execution / Privilege Escalation

Hi @ll, the executable installer of the Intel Extreme Tuning Utility, version 6.4.1.23 Latest, released 5/18/2018, available from via is SURPRISE! vulnerable. CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Vulnerability 0: ================= The executable installer XTU-Setup.exe comes with at least...

VPNFilter Router Malware Adds 7 New Network Exploitation Modules

Security researchers have discovered even more dangerous capabilities in VPNFilter—the highly sophisticated multi-stage malware that infected 500,000 routers worldwide in May this year, making it much more widespread and sophisticated than earlier. Attributed to Russia's APT 28, also known as...

CVE-2017-3912

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

CVE-2017-3912 McAfee Application Control and Change Control (MACC) - password management security feature bypass (SFB) leading to an authentication bypass

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...