Security News

CVE-2018-10805

National Vulnerability Database - Tue, 05/08/2018 - 03:29
ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.
Categories: Security News

CVE-2018-10806

National Vulnerability Database - Tue, 05/08/2018 - 03:29
An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. This can be used in conjunction with CSRF.
Categories: Security News

CVE-2018-10809

National Vulnerability Database - Tue, 05/08/2018 - 03:29
In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222040. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-8873.
Categories: Security News

CVE-2018-10801

National Vulnerability Database - Tue, 05/08/2018 - 02:29
TIFFClientOpen in tif_unix.c in LibTIFF 3.8.2 has memory leaks, as demonstrated by bmp2tiff.
Categories: Security News

CVE-2017-17539

National Vulnerability Database - Tue, 05/08/2018 - 00:29
The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell.
Categories: Security News

CVE-2017-17540

National Vulnerability Database - Tue, 05/08/2018 - 00:29
The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell.
Categories: Security News

CVE-2018-10796

National Vulnerability Database - Tue, 05/08/2018 - 00:29
In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222014.
Categories: Security News

CVE-2018-10798

National Vulnerability Database - Tue, 05/08/2018 - 00:29
A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling of JavaScript code that triggers the reload of a page continuously with an interval of 1 second.
Categories: Security News

CVE-2018-10799

National Vulnerability Database - Tue, 05/08/2018 - 00:29
A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the mishandling of a long URL formed by window.location+='?\u202a\uFEFF\u202b'; concatenation in a SCRIPT element.
Categories: Security News

Vuln: Microsoft Windows CVE-2017-11927 Information Disclosure Vulnerability

SecurityFocus Vulnerabilities - Tue, 05/08/2018 - 00:00
Microsoft Windows CVE-2017-11927 Information Disclosure Vulnerability
Categories: Security News

Vuln: Microsoft Internet Explorer VBScript Engine CVE-2018-8174 Arbitrary Code Execution Vulnerability

SecurityFocus Vulnerabilities - Tue, 05/08/2018 - 00:00
Microsoft Internet Explorer VBScript Engine CVE-2018-8174 Arbitrary Code Execution Vulnerability
Categories: Security News

CVE-2018-1256

National Vulnerability Database - Mon, 05/07/2018 - 12:22
Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.
Categories: Security News

CVE-2018-10795

National Vulnerability Database - Mon, 05/07/2018 - 09:29
Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or html/js/editor/fckeditor/editor/filemanager/browser/liferay/browser.html URI.
Categories: Security News

CVE-2018-1313

National Vulnerability Database - Mon, 05/07/2018 - 09:29
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.
Categories: Security News

CVE-2018-1413

National Vulnerability Database - Mon, 05/07/2018 - 09:29
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138819.
Categories: Security News

CVE-2018-10773

National Vulnerability Database - Mon, 05/07/2018 - 03:29
NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by copac2xml.
Categories: Security News

CVE-2018-10774

National Vulnerability Database - Mon, 05/07/2018 - 03:29
Read access violation in the isiin_keyword function in isiin.c in libbibutils.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by isi2xml.
Categories: Security News

CVE-2018-10775

National Vulnerability Database - Mon, 05/07/2018 - 03:29
NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by end2xml.
Categories: Security News

CVE-2018-10776

National Vulnerability Database - Mon, 05/07/2018 - 03:29
The getbits function in mpglibDBL/common.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (segmentation fault and application crash) or possibly have unspecified other impact.
Categories: Security News

CVE-2018-10777

National Vulnerability Database - Mon, 05/07/2018 - 03:29
Buffer overflow in the WriteMP3GainAPETag function in apetag.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Categories: Security News

Pages