The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Dell EMC Unisphere

computer weakness announce CVE-2018-16850

PostgreSQL: SQL injection via pg_upgrade/pg_dump

Synthesis of the vulnerability

An attacker can use a SQL injection via pg_upgrade/pg_dump of PostgreSQL, in order to read or alter data.
Severity: 2/4.
Creation date: 08/11/2018.
Revision date: 09/11/2018.
Identifiers: 528379, CVE-2018-16850, DLA-1642-1, DSA-2018-208, openSUSE-SU-2018:3893-1, openSUSE-SU-2018:4031-1, RHSA-2018:3757-01, SUSE-SU-2018:3770-1, SUSE-SU-2018:3770-2, USN-3818-1, VIGILANCE-VUL-27738.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The PostgreSQL product uses a database.

However, user's data are directly inserted in a SQL query.

An attacker can therefore use a SQL injection via pg_upgrade/pg_dump of PostgreSQL, in order to read or alter data.
Full Vigil@nce bulletin... (Free trial)

computer weakness announce CVE-2018-16842

libcurl: out-of-bounds memory reading via Warning Message

Synthesis of the vulnerability

An attacker can force a read at an invalid address via Warning Message of libcurl, in order to trigger a denial of service, or to obtain sensitive information.
Severity: 2/4.
Creation date: 31/10/2018.
Identifiers: bulletinoct2018, CVE-2018-16842, DLA-1568-1, DSA-2019-114, DSA-4331-1, FEDORA-2018-298a3d2923, FEDORA-2018-69bac0f51c, FEDORA-2018-7785911c9e, FEDORA-2018-fdc4ca8675, openSUSE-SU-2018:3699-1, openSUSE-SU-2018:3706-1, RHSA-2019:2181-01, SSA:2018-304-01, STORM-2019-002, SUSE-SU-2018:3624-1, SUSE-SU-2018:3681-1, SUSE-SU-2019:0339-1, USN-3805-1, USN-3805-2, VIGILANCE-VUL-27650.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can force a read at an invalid address via Warning Message of libcurl, in order to trigger a denial of service, or to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer weakness CVE-2018-16840

libcurl: use after free via Curl_close

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via Curl_close() of libcurl, in order to trigger a denial of service, and possibly to run code.
Severity: 2/4.
Creation date: 31/10/2018.
Identifiers: bulletinoct2018, CVE-2018-16840, DSA-2019-114, FEDORA-2018-298a3d2923, FEDORA-2018-69bac0f51c, FEDORA-2018-7785911c9e, FEDORA-2018-fdc4ca8675, openSUSE-SU-2018:3699-1, openSUSE-SU-2018:3706-1, SSA:2018-304-01, SUSE-SU-2018:3624-1, SUSE-SU-2018:3681-1, SUSE-SU-2019:0339-1, USN-3805-1, VIGILANCE-VUL-27649.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can force the usage of a freed memory area via Curl_close() of libcurl, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

weakness note CVE-2018-3136 CVE-2018-3139 CVE-2018-3149

Oracle Java: vulnerabilities of October 2018

Synthesis of the vulnerability

Several vulnerabilities were announced in Oracle products.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 11.
Creation date: 17/10/2018.
Identifiers: 528379, CERTFR-2018-AVI-495, cpuoct2018, CVE-2018-3136, CVE-2018-3139, CVE-2018-3149, CVE-2018-3150, CVE-2018-3157, CVE-2018-3169, CVE-2018-3180, CVE-2018-3183, CVE-2018-3209, CVE-2018-3211, CVE-2018-3214, DLA-1590-1, DSA-2018-208, DSA-2019-131, DSA-4326-1, FEDORA-2018-209371341e, FEDORA-2018-369ab0efc9, FEDORA-2018-5857f28069, FEDORA-2018-cca64e06ba, FEDORA-2018-ce61c1147d, ibm10729607, ibm10741443, ibm10742147, ibm10742149, ibm10743955, ibm10793419, ibm10796096, ibm10875314, ibm10881644, ibm10882604, ibm10883400, openSUSE-SU-2018:3235-1, openSUSE-SU-2019:0042-1, openSUSE-SU-2019:0043-1, RHSA-2018:2942-01, RHSA-2018:2943-01, RHSA-2018:3000-01, RHSA-2018:3001-01, RHSA-2018:3002-01, RHSA-2018:3003-01, RHSA-2018:3007-01, RHSA-2018:3008-01, RHSA-2018:3350-01, RHSA-2018:3409-01, RHSA-2018:3521-01, RHSA-2018:3533-01, RHSA-2018:3534-01, RHSA-2018:3671-01, RHSA-2018:3672-01, SB10255, SUSE-SU-2018:3868-1, SUSE-SU-2018:3920-1, SUSE-SU-2018:3921-1, SUSE-SU-2018:3933-1, SUSE-SU-2018:4064-1, SUSE-SU-2019:0049-1, SUSE-SU-2019:0057-1, SUSE-SU-2019:0057-2, SUSE-SU-2019:0058-1, USN-3804-1, USN-3824-1, USN-3830-1, VIGILANCE-VUL-27509, ZDI-18-1263.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Oracle products.
Full Vigil@nce bulletin... (Free trial)

security bulletin CVE-2018-14618

curl: integer overflow via Curl_ntlm_core_mk_nt_hash

Synthesis of the vulnerability

An attacker can generate an integer overflow via Curl_ntlm_core_mk_nt_hash() of curl, in order to trigger a denial of service, and possibly to run code.
Severity: 2/4.
Creation date: 05/09/2018.
Identifiers: bulletinoct2018, CVE-2018-14618, DLA-1498-1, DSA-2019-114, DSA-4286-1, FEDORA-2018-111044d435, FEDORA-2018-ba443bcb6d, ibm10743283, openSUSE-SU-2018:2731-1, openSUSE-SU-2018:2736-1, RHSA-2018:3558-01, RHSA-2019:1880-01, SSA:2018-249-01, SUSE-SU-2018:2714-1, SUSE-SU-2018:2715-1, SUSE-SU-2018:2717-1, USN-3765-1, USN-3765-2, VIGILANCE-VUL-27143.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate an integer overflow via Curl_ntlm_core_mk_nt_hash() of curl, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

threat bulletin CVE-2018-3646

Intel processors: information disclosure via Foreshadow L1TF Virtualization

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via L1TF Virtualization on Intel processors, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 16/08/2018.
Identifiers: 525211, 528031, ADV180018, CERTFR-2018-AVI-385, CERTFR-2018-AVI-386, CERTFR-2018-AVI-387, CERTFR-2018-AVI-388, CERTFR-2018-AVI-390, CERTFR-2018-AVI-391, CERTFR-2018-AVI-392, CERTFR-2018-AVI-416, CERTFR-2018-AVI-419, CERTFR-2018-AVI-426, CERTFR-2018-AVI-557, CERTFR-2018-AVI-584, CERTFR-2019-AVI-169, CERTFR-2019-AVI-242, CERTFR-2019-AVI-489, cisco-sa-20180814-cpusidechannel, cpuapr2019, cpujan2019, CTX236548, CVE-2018-3646, DLA-1481-1, DLA-1506-1, DSA-2018-170, DSA-2018-217, DSA-2019-030, DSA-4274-1, DSA-4279-1, DSA-4279-2, FEDORA-2018-1c80fea1cd, FEDORA-2018-f8cba144ae, FG-IR-18-002, Foreshadow, FreeBSD-SA-18:09.l1tf, HPESBHF03874, HT209139, HT209193, ibm10742755, INTEL-SA-00161, JSA10937, K31300402, openSUSE-SU-2018:2399-1, openSUSE-SU-2018:2404-1, openSUSE-SU-2018:2407-1, openSUSE-SU-2018:2434-1, openSUSE-SU-2018:2436-1, openSUSE-SU-2018:4304-1, RHSA-2018:2384-01, RHSA-2018:2387-01, RHSA-2018:2388-01, RHSA-2018:2389-01, RHSA-2018:2390-01, RHSA-2018:2391-01, RHSA-2018:2392-01, RHSA-2018:2393-01, RHSA-2018:2394-01, RHSA-2018:2395-01, RHSA-2018:2396-01, RHSA-2018:2602-01, RHSA-2018:2603-01, SSA-254686, SSA-608355, STORM-2018-005, SUSE-SU-2018:2328-1, SUSE-SU-2018:2331-1, SUSE-SU-2018:2332-1, SUSE-SU-2018:2335-1, SUSE-SU-2018:2338-1, SUSE-SU-2018:2344-1, SUSE-SU-2018:2362-1, SUSE-SU-2018:2366-1, SUSE-SU-2018:2374-1, SUSE-SU-2018:2380-1, SUSE-SU-2018:2381-1, SUSE-SU-2018:2384-1, SUSE-SU-2018:2394-1, SUSE-SU-2018:2401-1, SUSE-SU-2018:2409-1, SUSE-SU-2018:2410-1, SUSE-SU-2018:2480-1, SUSE-SU-2018:2482-1, SUSE-SU-2018:2483-1, SUSE-SU-2018:2528-1, SUSE-SU-2018:2596-1, SUSE-SU-2018:2637-1, SUSE-SU-2018:3490-1, SUSE-SU-2018:4300-1, Synology-SA-18:45, USN-3740-1, USN-3740-2, USN-3741-1, USN-3741-2, USN-3741-3, USN-3742-1, USN-3742-2, USN-3742-3, USN-3756-1, USN-3823-1, VIGILANCE-VUL-26999, VMSA-2018-0020, VU#982149, XSA-273, XSA-289.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via L1TF Virtualization on Intel processors, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-3620

Intel processors: information disclosure via Foreshadow L1TF OS/SMM

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via L1TF OS/SMM on Intel processors, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 16/08/2018.
Identifiers: 525211, 528031, ADV180018, CERTFR-2018-AVI-385, CERTFR-2018-AVI-386, CERTFR-2018-AVI-387, CERTFR-2018-AVI-388, CERTFR-2018-AVI-390, CERTFR-2018-AVI-391, CERTFR-2018-AVI-392, CERTFR-2018-AVI-416, CERTFR-2018-AVI-419, CERTFR-2018-AVI-426, CERTFR-2018-AVI-557, CERTFR-2018-AVI-584, CERTFR-2019-AVI-169, CERTFR-2019-AVI-242, CERTFR-2019-AVI-489, cisco-sa-20180814-cpusidechannel, cpuapr2019, CTX236548, CVE-2018-3620, DLA-1481-1, DLA-1506-1, DLA-1529-1, DSA-2018-170, DSA-2018-217, DSA-2019-030, DSA-4274-1, DSA-4279-1, DSA-4279-2, FEDORA-2018-1c80fea1cd, FEDORA-2018-f8cba144ae, FG-IR-18-002, Foreshadow, FreeBSD-SA-18:09.l1tf, HPESBHF03874, ibm10742755, INTEL-SA-00161, JSA10917, JSA10937, K95275140, openSUSE-SU-2018:2404-1, openSUSE-SU-2018:2407-1, RHSA-2018:2384-01, RHSA-2018:2387-01, RHSA-2018:2388-01, RHSA-2018:2389-01, RHSA-2018:2390-01, RHSA-2018:2391-01, RHSA-2018:2392-01, RHSA-2018:2393-01, RHSA-2018:2394-01, RHSA-2018:2395-01, RHSA-2018:2396-01, RHSA-2018:2602-01, RHSA-2018:2603-01, SSA:2018-240-01, SSA-254686, SSA-608355, STORM-2018-005, SUSE-SU-2018:2328-1, SUSE-SU-2018:2332-1, SUSE-SU-2018:2344-1, SUSE-SU-2018:2362-1, SUSE-SU-2018:2366-1, SUSE-SU-2018:2374-1, SUSE-SU-2018:2380-1, SUSE-SU-2018:2381-1, SUSE-SU-2018:2384-1, SUSE-SU-2018:2596-1, SUSE-SU-2018:2637-1, Synology-SA-18:45, USN-3740-1, USN-3740-2, USN-3741-1, USN-3741-2, USN-3741-3, USN-3742-1, USN-3742-2, USN-3742-3, USN-3823-1, VIGILANCE-VUL-26998, VMSA-2018-0021, VU#982149, XSA-273, XSA-289.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via L1TF OS/SMM on Intel processors, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

threat CVE-2018-10925

PostgreSQL: information disclosure via CONFLICT DO UPDATE

Synthesis of the vulnerability

A local attacker can read a memory fragment via CONFLICT DO UPDATE of PostgreSQL, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 10/08/2018.
Identifiers: 528379, CVE-2018-10925, DSA-2018-208, DSA-4269-1, FEDORA-2018-d8f5aea89d, openSUSE-SU-2018:2599-1, openSUSE-SU-2018:3449-1, RHSA-2018:2511-01, RHSA-2018:2565-01, RHSA-2018:2566-01, SUSE-SU-2018:2564-1, SUSE-SU-2018:3377-1, USN-3744-1, VIGILANCE-VUL-26960.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

A local attacker can read a memory fragment via CONFLICT DO UPDATE of PostgreSQL, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

weakness alert CVE-2018-10915

PostgreSQL: privilege escalation via Libpq Host Connection Parameters

Synthesis of the vulnerability

An attacker can bypass restrictions via Libpq Host Connection Parameters of PostgreSQL, in order to escalate his privileges.
Severity: 2/4.
Creation date: 10/08/2018.
Identifiers: 528379, CVE-2018-10915, DLA-1464-1, DSA-2018-208, DSA-2019-131, DSA-4269-1, FEDORA-2018-d8f5aea89d, openSUSE-SU-2018:2599-1, openSUSE-SU-2018:3449-1, openSUSE-SU-2018:4007-1, RHSA-2018:2511-01, RHSA-2018:2557-01, RHSA-2018:2565-01, RHSA-2018:2566-01, SUSE-SU-2018:2564-1, SUSE-SU-2018:3287-1, SUSE-SU-2018:3377-1, SUSE-SU-2018:3909-1, USN-3744-1, VIGILANCE-VUL-26959.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass restrictions via Libpq Host Connection Parameters of PostgreSQL, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

threat announce CVE-2018-11236

glibc: integer overflow via stdlib/canonicalize.c

Synthesis of the vulnerability

An attacker can generate an integer overflow via stdlib/canonicalize.c of glibc, in order to trigger a denial of service, and possibly to run code.
Severity: 2/4.
Creation date: 06/06/2018.
Identifiers: cpuapr2019, CVE-2018-11236, DSA-2019-114, ibm10880783, openSUSE-SU-2018:1600-1, openSUSE-SU-2018:2159-1, RHSA-2018:3092-01, SUSE-SU-2018:1562-1, SUSE-SU-2018:1991-1, SUSE-SU-2018:2185-1, SUSE-SU-2018:2187-1, SUSE-SU-2018:2302-1, VIGILANCE-VUL-26325.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate an integer overflow via stdlib/canonicalize.c of glibc, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.