SaferVPN for Windows Privileged Access Vulnerability

SaferVPN for Windows is a Windows-based VPN software. A power lifting vulnerability exists in the SaferVPN.Service service in SaferVPN version 4.2.5 for Windows-based platforms. An attacker can exploit this vulnerability to execute code as the SYSTEM user by modifying a configuration file to...

Unauthenticated Access

spring-cloud-sso-connector is vulnerable to unauthenticated access. The vulnerability exists due to a regression caused in version 2.1.2, which disables issuer validation in resource servers when PCF is deployed with multiple SSO service plans, allowing malicious users to authenticate to unbound...

Frog CMS 0.9.5 Cross Site Scripting

Exploit Title: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings Date: 2018-04-23 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/philippe/FrogCMS Software Link: https://github.com/philippe/FrogCMS Version: 0.9.5 Tested on: php 5.6...

Leptonica Command Injection Vulnerability

Leptonica is an open source system for image processing and image analysis applications. A command injection vulnerability exists in the 'gplotMakeOutput' function in Leptonica version 1.74.4. An attacker can exploit this vulnerability by entering a malicious path to execute arbitrary code...

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

Microsoft Word 2016 Information Disclosure Vulnerability (KB4018339)

This host is missing an important security update according to Microsoft KB4018339 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Dolibarr <= 7.0.0 Multiple Vulnerabilities

Dolibarr is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dolibarr:dolibarr"; if description...

Fedora Update for ImageMagick FEDORA-2018-5673d070df

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Windows Master Denial of Service Vulnerability (CNVD-2018-07030)

Windows Master aka Windows Optimization Master is a set of Windows optimization tools. The tool features system detection, system optimization, system cleanup and system maintenance. A security vulnerability exists in the WoptiHWDetect.SYS driver file in Windows Master version 7.99.13.604, which...

windows Master Denial of Service Vulnerability (CNVD-2018-07538)

Windows Master aka Windows Optimization Master is a set of Windows optimization tools. The tool features system detection, system optimization, system cleanup and system maintenance. A security vulnerability exists in the WoptiHWDetect.SYS driver file in Windows Master version 7.99.13.604, which...

dsmall cross-site scripting vulnerability (CNVD-2018-07546)

dsmall is a multi-user platform-level online shopping mall system. A cross-site scripting vulnerability exists in dsmall version 20180320. A remote attacker can use the main page query box in the public/index.php/home URI to inject arbitrary HTML/JavaScript code to obtain sensitive information...

Microsoft Office 2016 Click-to-Run (C2R) Security Bypass Vulnerability (Mar 2018)

This host is missing an important security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

Fedora Update for net-snmp FEDORA-2018-5a5f51753c

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Panda Global Protection <= 17.0.1 Multiple Vulnerabilities

Panda Global Protection is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Grav CMS system/src/Grav/Common/Twig/Twig.php file cross-site scripting vulnerability

Grav CMS is a scalable CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. A cross-site scripting vulnerability exists in the system/src/Grav/Common/Twig/Twig.php file in Grav CMS version 1.3.0. A remote attacker can inject...

Fedora Update for firefox FEDORA-2018-a068ade416

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for zsh FEDORA-2018-019a32a468

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Tuleap 9.17.99.189 - Blind SQL Injection

=============================================================================== title: Tuleap SQL Injection case id: CM-2018-01 product: Tuleap version 9.17.99.189 vulnerability type: Blind SQL injection - time based severity: High found: 2018-02-24 by: Cristiano Maruti @cmaruti...

UBUNTU-CVE-2018-7184

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service disruption by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the mos...