CVE-2018-1808

IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828...

org.apache.syncope:syncope-core-upgrader (>=1.2.0 <=1.2.10), org.apache.syncope:syncope-standalone (>=1.1.0 <=1.1.8) potentially affected by CVE-2018-1321 via org.apache.syncope:syncope-core (>=1.1.0 <=1.2.10)

org.apache.syncope:syncope-core MAVEN version =1.1.0, =1.2.0, =1.1.0, =1.1.8 Source cves: CVE-2018-1321 Source advisory: OSV:GHSA-XGC9-9W4V-H33H...

org.apache.activemq:apache-activemq (>=5.0.0 <=5.15.16), org.apache.axis2:axis2-integration (=1.4) +3 more potentially affected by CVE-2018-8006 via org.apache.activemq:activemq-web-console (>=5.0.0 <=5.15.5)

org.apache.activemq:activemq-web-console MAVEN version =5.0.0, =5.0.0, =5.15.16 - org.apache.axis2:axis2-integration =1.4 - org.apache.camel:camel-example-cxf =1.3.0 - org.apache.camel:camel-example-jms-file =1.3.0 - org.apache.camel:camel-example-spring-xquery =1.3.0 Source cves: CVE-2018-8006...

IBM WebSphere Commerce Information Disclosure Vulnerability (CNVD-2018-22088)

IBM WebSphere Commerce is a suite of e-business solutions from IBM in the United States. The solution supports all sales business models, including B2C, B2B and B2B2C, on a single customer interaction platform. An information disclosure vulnerability exists in IBM WebSphere Commerce versions...

br.eti.clairton:ds-test (=0.4.0), br.jus.stf.digital:core (>=2.0.0 <=2.3.1) +420 more potentially affected by CVE-2017-2666 via io.undertow:undertow-core (>=1.4.0.Beta1 <=1.4.16.Final)

io.undertow:undertow-core MAVEN version =1.4.0.Beta1, =2.0.0, =0.2.7, =1.2.0, =1, =1, =1.0, =1.1 - com.fizzed:ninja-undertow =5.7.0.undertow2 - com.gitblit.fathom:fathom-core =0.9.0 - com.gitblit.fathom:fathom-eventbus =0.9.0 - com.gitblit.fathom:fathom-integration-test =0.9.0 -...

com.feelercloud:esap-mesh (=2.0.32), com.github.arucard21.simplyrestful:simplyrestful-jetty (=0.5) +439 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (>=3.2.0 <=3.2.4)

org.apache.cxf:cxf-rt-transports-http MAVEN version =3.2.0, =0.0.1, =1.0.3, =1.0.3, =1.0.0.RELEASE, =2.6.0, =2.0.0, =1.3.0-RELEASE, =2.0.1-RELEASE - de.alpharogroup:gen-db-core =0.9.3 - de.alpharogroup:gen-db-sources =0.9.3 and more Source cves: CVE-2018-8039 Source advisory: OSV:GHSA-JC7R-V6FG-2...

org.apache.cxf.fediz.examples:jaxrsSpringSecurityWebapp (>=1.4.0 <=1.4.2), org.apache.cxf.fediz.examples:springPreauthWebapp (>=1.4.0 <=1.4.2) +4 more potentially affected by CVE-2017-12631 via org.apache.cxf.fediz:fediz-spring (>=1.4.0 <=1.4.2)

org.apache.cxf.fediz:fediz-spring MAVEN version =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.2 Source cves: CVE-2017-12631 Source advisory: OSV:GHSA-FV7X-4HPC-HF9F...

ai.ylyue:yue-library-base (>=Finchley.SR2.SR1 <=Finchley.SR4.1), ai.ylyue:yue-library-base-crypto (>=Finchley.SR4 <=Finchley.SR4.1) +3028 more potentially affected by CVE-2018-1271 via org.springframework:spring-core (>=5.0.0.RELEASE <=5.0.4.RELEASE)

org.springframework:spring-core MAVEN version =5.0.0.RELEASE, =Finchley.SR2.SR1, =Finchley.SR4, =Finchley.SR2.SR1, =Finchley.SR2.SR1, =Finchley.SR4, =0.0.1, =0.0.2, =2.0.3.RELEASE, =2.0.3.RELEASE, =2.0.3.RELEASE, =2.0.3.RELEASE, =2.0.2.RELEASE, =2.0.2.RELEASE, =2.0.3.RELEASE, =2.0.7.RELEASE and...

at.chrl:chrl-jms (=1.1.0), ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0 <=0.3.0) +1574 more potentially affected by CVE-2018-1270 via org.springframework:spring-messaging (>=4.0.1.RELEASE <=4.3.15.RELEASE)

org.springframework:spring-messaging MAVEN version =4.0.1.RELEASE, =0.2.0, =1.4, =1.4, =1.1.0, =1.1.1, =1.1.0, =1.0.0, =1.0.1 and more Source cves: CVE-2018-1270 Source advisory: OSV:GHSA-P5HG-3XM3-GCJG...

cc.catalysts.boot:cat-boot-report-pdf (=0.0.10), com.bit-scout:pdf-converter (=1.0.0) +227 more potentially affected by CVE-2018-11797 via org.apache.pdfbox:pdfbox (>=1.8.0 <=1.8.15)

org.apache.pdfbox:pdfbox MAVEN version =1.8.0, =0.6, =0.9, =3.0, =1.3.3-2.10, =0.0.2, =0.0.2, =1.0, =1.0, =1.0, =1.3 and more Source cves: CVE-2018-11797 Source advisory: OSV:GHSA-GX96-VGF7-HWFG...

com.graphaware.neo4j:server (>=3.4.0.52 <=3.4.12.52), com.graphaware.neo4j:tests (>=3.4.0.52 <=3.4.12.52) +17 more potentially affected by CVE-2018-18389 via org.neo4j:neo4j-enterprise (>=3.4.0 <=3.4.8)

org.neo4j:neo4j-enterprise MAVEN version =3.4.0, =3.4.0.52, =3.4.0.52, =3.0.0, =2.1.5, =2.1.5, =2.1.5, =2.1.5, =3.4.0, =3.4.0, =0.1.9, =0.2.7 and more Source cves: CVE-2018-18389 Source advisory: OSV:GHSA-H5F5-RJ4R-42F6...

CVE-2018-3189

Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite subcomponent: Outcome-Result. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

org.apache.struts:struts2-assembly (>=2.5.1 <=2.5.12), org.apache.struts:struts2-rest-showcase (>=2.5.1 <=2.5.12) potentially affected by CVE-2017-9793 +1 more via org.apache.struts:struts2-rest-plugin (>=2.5.1 <=2.5.12)

org.apache.struts:struts2-rest-plugin MAVEN version =2.5.1, =2.5.1, =2.5.1, =2.5.12 Source cves: CVE-2017-9793, CVE-2017-9805 Source advisory: OSV:GHSA-VWXJ-6M5M-RRVH...

bouncycastle: Carry propagation bug in math.raw.Nat??? class

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed org.bouncycastle.math.raw.Nat???. These classes are used by our custom elliptic curve implementations...

Wireshark Denial of Service Vulnerability (CNVD-2019-18506)

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A denial of service vulnerability exists in the CoAP parser in Wireshark versions 2.6.0...

DEBIAN-CVE-2018-1000805

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity...

cloudxns-ddns-service (=1.0.0), coderedcms (>=0.10.0 <=0.14.1) +97 more potentially affected by CVE-2018-16984 via django (>=2.1.0 <=2.1.15)

django PYPI version =2.1.0, =0.10.0, =2.4.0, =0.3.1, =0.1.6, =0.2.0, =1.3.2, =0.1.0, =0.1.0a3 - django-basicauth =0.5.1 - django-brunch =1.0.3 and more Source cves: CVE-2018-16984 Source advisory: OSV:GHSA-6MX3-3VQG-HPP2...

PT-2018-14016 · Phonepe · Phonepe

Name of the Vulnerable Software and Affected Versions: PhonePe wallet aka com.PhonePe.app versions 3.0.6 through 3.3.26 Description: The issue might allow attackers to impersonate a user and set up their account without their knowledge. To exploit this, the user has to explicitly install a...

UBUNTU-CVE-2018-11761

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack...

88slot-ap (=1.0.0), @bipsync/apiclient (>=0.0.23 <=0.2.5) +163 more potentially affected by CVE-2018-16459 via exceljs (>=0.2.11 <=1.5.1)

exceljs NPM version =0.2.11, =0.0.23, =1.0.12, =2.0.2, =2.0.0, =1.1.0, =1.0.0, =1.0.3, =0.2.0, =1.0.0, =1.0.3, =1.0.0, =1.0.0, =1.2.0 and more Source cves: CVE-2018-16459 Source advisory: OSV:GHSA-2J2J-8RRV-264G...