Prototype Pollution in cached-path-relative

Version of cached-path-relative before 1.0.2 are vulnerable to prototype pollution. Recommendation Update to version 1.0.2 or later...

GHSA-HC9W-4P87-J549 Prototype Pollution in cached-path-relative

Version of cached-path-relative before 1.0.2 are vulnerable to prototype pollution. Recommendation Update to version 1.0.2 or later...

Microsoft ASP.NET Core Security Feature Bypass Vulnerability (Jul 2018)

This host is missing an important security update according to Microsoft advisory CVE-2018-8171. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

openssl: Read/write after SSL object in error state

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0737)

Summary There is a vulnerability in OpenSSL used by AIX. Vulnerability Details CVEID: CVE-2018-0737 DESCRIPTION: The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during...

Security Bulletin: IBM SDN for Virtual Environments is affected by a vulnerability in OpenSSL (CVE-2014-0224)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle...

OpenSSL Denial of Service Vulnerability (CNVD-2018-12153)

OpenSSL is an open source capable of implementing the Secure Sockets Layer SSL v2/v3 and Secure Transport Layer TLS v1 protocols developed by the OpenSSL team as a general-purpose cryptographic library that supports a wide range of cryptographic algorithms including symmetric ciphers, hash...

PT-2018-16153 · Unknown · Localhost-Now

Name of the Vulnerable Software and Affected Versions: localhost-now versions prior to 1.0.2 Description: The issue arises from a lack of validation of file paths, allowing a malicious user to read the content of any file with a known path. This can be exploited by a remote attacker to read...

CVE-2018-1000180

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 bet...

Synology Drive File Sharing Notify Toast Cross-Site Scripting Vulnerability

Synology Drive is a collaboration suite from Synology that includes document management, collaboration and file synchronization and backup features.File Sharing Notify Toast is one of the file sharing components. A cross-site scripting vulnerability exists in File Sharing Notify Toast in Synology...

Synology Drive Access Control Error Vulnerability

Synology Drive is a collaboration suite from Synology that includes document management, collaboration and file synchronization and backup. An access control error vulnerability exists in Synology Drive versions prior to 1.0.2-10275. A remote attacker can exploit the vulnerability to access...

CVE-2018-8922

Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecified vectors...

CVE-2018-8921

Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...

PT-2018-18719 · Synology · Synology Drive

Name of the Vulnerable Software and Affected Versions: Synology Drive versions prior to 1.0.2-10275 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via a malicious file name, exploiting a cross-site scripting XSS vulnerability in the File Sharing...

MyBB ChangUonDyU Advanced Statistics Plugin Cross-Site Scripting Vulnerability

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL.ChangUonDyU Advanced Statistics plugin is used in one of the forum plugin. A cross-site scripting vulnerability exists in version 1.0.2 of the MyBB ChangUonDyU Advanced Statistics plugin. A...

ibm_db Code Execution Vulnerability

ibmdb is an asynchronous/synchronous interface linking node.js and IBM DB2. A security vulnerability exists in ibmdb versions prior to 1.0.2 that originates when a program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing the request...

Malicious Package

Overview Version 1.0.2 of awesomereactutility contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.2 of this module is found...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.springframework.integration:spring-integration-zip provides Zip un- compression support. Affected versions of the package are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". It is exploited using a specially crafted zip archive, that holds path traversal...

HRSALE The Ultimate HRM Cross-Site Scripting Vulnerability

HRSALE The Ultimate HRM is a PHP-based human resource management system. A cross-site scripting vulnerability exists in HRSALE The Ultimate HRM version 1.0.2, which originates from the program failing to validate user-submitted input. A remote attacker can exploit this vulnerability by injecting...

HRSALE The Ultimate HRM SQL Injection Vulnerability

HRSALE The Ultimate HRM is a PHP-based human resource management system. A SQL injection vulnerability exists in HRSALE The Ultimate HRM version 1.0.2. The vulnerability can be exploited by remote attackers to directly alter SQL query statements with the 'awardid' parameter...