1 April 2019

19 results · Clear filters · Feed

• Medium 6.8
  CVE-2019-3792

  Concourse 5.0.0 SQL Injection vulnerability

  Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.

  Pivotal Concourse github.com/concourse/concourse Go
  Apr 1, 2019
• Medium 4.3
  CVE-2018-13299

  Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authe…

  Synology Calendar
  Apr 1, 2019
• Medium 4.2
  CVE-2018-13298

  Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows ma…

  Synology Android Moments Android
  Apr 1, 2019
• Medium 5.3
  CVE-2018-13297

  Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attac…

  Synology Drive
  Apr 1, 2019
• Medium 4.3
  CVE-2018-13294

  Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows re…

  Synology Application Service
  Apr 1, 2019
• Medium 4.3
  CVE-2018-13295

  Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 …

  Synology Application Service
  Apr 1, 2019
• Medium 4.3
  CVE-2018-13291

  Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824…

  Synology DiskStation Manager (DSM)
  Apr 1, 2019
• Medium 5.9
  CVE-2018-13293

  Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2…

  Synology DiskStation Manager (DSM)
  Apr 1, 2019
• Medium 4.3
  CVE-2018-13292

  Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 all…

  Synology Synology Router Manager (SRM)
  Apr 1, 2019
• Medium 4.3
  CVE-2018-13290

  Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote …

  Synology Synology Router Manager (SRM)
  Apr 1, 2019
• Medium 5.3
  CVE-2018-13289

  Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allo…

  Synology Synology Router Manager (SRM)
  Apr 1, 2019
• Medium 5.3
  CVE-2018-13288

  Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1…

  Synology File Station
  Apr 1, 2019
• Medium 6.5
  CVE-2018-13287

  Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allow…

  Synology Synology Router Manager (SRM)
  Apr 1, 2019
• Medium 6.5
  CVE-2018-13286

  Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 a…

  Synology DiskStation Manager (DSM)
  Apr 1, 2019
• Medium 6.5
  CVE-2017-16774

  Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) …

  Synology DiskStation Manager (DSM)
  Apr 1, 2019
• Medium 5.9
  CVE-2019-3836

  It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versi…

  gnutls gnutls gnutls28 gnutls Debian Alpine
  Apr 1, 2019
• Medium 5.0
  CVE-2019-3876

  A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation …

  Red Hat web-console
  Apr 1, 2019
• Medium 6.4
  CVE-2019-1002101 Public exploit EPSS 13%

  kubectl cp path traversal

  The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in …

  Kubernetes Kubernetes k8s.io/kubernetes Go
  Apr 1, 2019
• Medium 6.5
  CVE-2019-1002100 EPSS 17%

  Kubernetes DoS Vulnerability

  In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: appli…

  Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  Apr 1, 2019