Nexus: Search results for Technology

List of Top Engineering Colleges in India

Read

Name of Institute

1-Indian Institute of Technology IIT Kanpur

2-Indian Institute of Technology IIT Kharagpur

3-Indian Institute of Technology IIT Bombay

4-Indian Institute of Technology IIT Madras

5-Indian Institute of Technology IIT Delhi

6-BITS Pilani

7-IIT Roorkee

8-IT-BHU

9-IIT-Guwahati

10-College of Engg , Anna University, Guindy

11-Jadavpur University , Faculty of Engg & Tech., Calcutta

12-Indian School of Mines, Dhanbad

13-NIT- National Institute of Technology Warangal

14-BIT, Mesra

15-NIT- National Institute of Technology Trichy

16-Delhi College of Engineering , Delhi

17-Punjab Engineering College, Chandigarh

18-NIT- National Institute of Technology, Suratkal

19-Motilal Nehru National Inst. of Technology, Allahabad

20-Thapar Inst of Engineering & Technology, Patiala

21-Bengal Eng and Science University , Shibpur

22-MANIT Malviya National Institute of Technology Bhopal

23-PSG College of Technology Coimbatore

24-IIIT - International Institute of Information Technology Hyderabad

25-Harcourt Butler Technological Institute (HBTI), Kanpur

26-Malviya National Institute of Technology, Jaipur

27-VNIT - Visvesvaraya National Institute of Technology Nagpur

28-NIT- National Institute of Technology, Calicut

29-Dhirubhai Ambani IICT, Gandhi Nagar

30-Osmania Univ. College of Engineering, Hyderabad

31-College of Engineering , Andhra University, Vishakhapatnam

32-Netaji Subhas Institute of Technology, New Delhi
33-NIT- National Institute of Technology Kurukshetra

34-NIT- National Institute of Technology Rourkela

35-SVNIT Surat

36-Govt. College of Engineering, Pune

37-Manipal Institute of Technology, Manipal

38-JNTU Hyderabad

39-R.V. College of Engineering Bangalore

40-NIT- National Institute of Technology Jamshedpur

41-University Visvesvaraya College of Engg.Bangalore

42-VJTI Mumbai

43-Vellore Institute of Technology, Vellore

44-Coimbatore Institute of Technology, Coimbatore

45-SSN College of Engineering, Chennai

46-IIIT, Allahabad

47-College of Engineering, Trivandrum

48-NIT Durgapur

49-SIT Calcutta

50-Mumbai University Inst of Chemical Tech., Mumbai

51-Sardar Patel College of Engineering, Mumbai

52-P.E.S. Institute of Technology, Bangalore

53-Maharashtra Inst itute of Technology (MIT), Pune

54-Amrita Institute of Technology & Science, Coimbatore

55-National Institute of Engineering, Mysore

56-B.M.S. College of Engineering, Bangalore

57-Laxminarayan Institute Of Tech., Nagpur

58-Nirma Institute of Technology, Ahmedabad

59-IIIT Pune

60-Amity School of Engineering Noida

61-JNTU Kakinada

62-S.J. College of Engineering, Mysore

63-Chaitanya Bharathi Inst. of Technology, Hyderabad

64-IIIT, Bangalore

65-SRM Institute of Science and Technology, Chennai

66-SASTRA, Thanjavur

67-Bangalore Institute of Technology Bangalore

68-The Technological Inst. of Textile & Sciences, Bhiwani

69-IIIT Gwalior

70-JNTU Anantpur

71-M.S. Ramaiah Institute of Technology Bangalore

72-Gitam Vishakhapatnam

73-NIT- National Institute of Tech nology Hamirpur

74-NIT- National Institute of Technology Jalandhar

75-SV University Engineering College Tirupati

76-NIT- National Institute of Technology Raipur

77-Vasavi College of Engineering Hyderabad

78-The ICFAI Inst of Science and Technology Hybd.

79-NIT- National Institute of Technology Patna

80-Cummins Colleges of Engg of Women Pune

81-VIT Pune

82-Shri Ramdeo Baba K.N. Engineering College Nagpur

83-Muffakham Jah Engineering College Hybd.

84-Karunya Institute of Technology, Coimbatore

85-D.J. Sanghvi Mumbai

86-Sathyabhama Engineering College Chennai

87-Kongu Engineering College Erode

88-Mepco Schlek Engineering College Sivakasi

89-Guru Nanak Dev Engineering College Ludhiana

90-Hindustan Inst of Engineering Technology Chennai

91-SDM College of Engineering Dharward

92-R.V.R. & J.C. College Of Engg Guntur

93-Jamia Millia Islamia, New Delhi

94-K.L. College of Engineering Veddeswaram

95-Dharmsinh Desai Institute of Technology Nadiad

96-S.G.S. Institute of Technology & Science Indore

97-Jabalpur Engineering College Jabalpur

98-Sree Chitra Thirunal College of Engineering Trivandrum

99-G.H. Patel College of Engg & Technology Vallabh Vidyanagar

100-Kalinga Institute of Industrial Technology Bhubaneshwar

Read More Add comment

Tackling Technology in Your Business Plan

By 0x000216

Read

0 Comments

In the present-day, technology has made solid roads into the business world, and this trend is only going to increase in many ways. Yes, technology does seem daunting for businesspeople doing business the old-fashioned way. But, there is hardly any choice for anyone wanting to promote business today and make it successful; they have to tackle technology in their plans.

Planning technology needs

Today, no business can survive without technology since it has invaded all aspects of business, whether it is maintaining financial records, processing orders, or keeping in touch with suppliers and customers. This brings us to the critical issue of opting for technology that is apt for your business, then planning to introduce it and use it.

Why plan technology?

It is essential that the technology you opt for should be integrated into the business plan from the beginning. This is because many decisions, such as selecting your database program, if not chosen initially, may become financially unviable should you decide to change it at a later date.

You will also have to envision the growth and change that your company might undergo over a period of time, and select the kind of technology that will survive such changes. Make sure to conduct a SWOT analysis of your firm – analyze strengths, weaknesses, opportunities and threats of your venture. Organizations need to consider all the factors, like customer service, social media marketing strategy, pricing, etc. to perform an efficient SWOT analysis. A cost-benefit analysis can also prove to be useful for your firm.

It is best to go for technology that is flexible and can be adapted to a changed scenario. The technology that you will integrate into your technology business plan also needs to be simple. So, avoid overly complex ones by resisting the temptation of extra ‘features’ that make the technology complex and, thereby, harder to use.

Which technology: Specialized or ‘Off the shelf?’

This will primarily be dictated by the kind of business your company is in. If your business has specific demands, it is best to go for industry-specific technology. You can easily get such technology from vendors who produce specialized software and hardware. Industry-specific software and hardware give you more compatibility, but they are also expensive. A mix of skilled and ‘off the shelf’ technology will prove a money-saver, without compromising on efficiency.

Key features of technology

When choosing technology, one should look for the functions it provides, its ease of use, the cost factor, security, and the ability to upgrade or expand it. Also, see if the technology can be integrated with any existing technology.

Where to use technology?

The answer to this question would come from your business operations. Look at the functions that can benefit from technology, such as accounting, taxes, inventory management, database management, desktop publishing, human resources management, etc.

Business plan with technology

A technology-heavy industry, such as e-commerce, will always come under the scrutiny of potential funders and venture capitalists. Seeking detailed information on the nature of technology helps to gauge its viability. In the business plan, you can include it under the head ‘Products and Services,’ or make a separate section for it. Describing technology in detail will cater to the expertise of the potential reader.

Exercise caution

It’s nice to spell out how efficient the technology is for your company, but giving out too much information and revealing confidential company information regarding technology should be guarded against. In a highly competitive environment, it may be used by your competitors to your disadvantage.

Your decisions regarding the kind of technology you opt for and its planning and implementation will have a good impact on the success of your business. So, make technology a business priority.

Featured photo credit: Paul Chessare via freeimages.com

The post Tackling Technology in Your Business Plan appeared first on Lifehack.

from Lifehack http://ift.tt/2liKA8X
via IFTTT

Read More Add comment

Is Technology the Key to Success in the 21st Century?

By 0x000216

Read

0 Comments

Technology advances by leaps and bounds. It seems like we’re always fighting to stay current on tech trends. Consumers aren’t alone in this race for the hottest products and services on the market. Many businesses are also eager to jump on the tech bandwagon.

Sometimes companies don’t do well on the cutting edge. The Daily, a digital newspaper that sought to ride the wave of success caused by the iPad, is a classic example. This e-newspaper showed promise, but wound up being a colossal flop.^[1]

Today, reading a newspaper on a tablet requires no stretch of the imagination. The Washington Post, The New York Times, and other major papers offer e-subscriptions. If The Daily had the right idea, why did it fail?

It wasn’t that the idea of an e-paper was bad. The combination of a clunky interface, a bad business model, an unclear mission, and high overhead made the paper unsustainable.^[2]

The Daily led with technology. They didn’t put as much focus on developing a user-friendly paper as they should have. They were trying to operate in a digital age with an analog mindset. They saw the importance of using tech to publish their stories, but they didn’t understand how to do that.

What We Think Technology Can Do

Using technology doesn’t guarantee that we’ll be successful, but many feel that tech holds the key to success. Technology has always defined our culture. From the invention of the wheel to the 21st century marvels of information technology, our way of life is tied to innovation.

We see success stories from wealthy public figures such as Mark Zuckerberg, Steve Jobs, and Jeff Bezos. All eyes are on Silicon Valley, and we’re all waiting to see what’s going to change our world next.

Upload a viral YouTube video, make a Facebook page that people like, become famous on Instagram, or build your own app, and you, too, can have the power and influence of someone like Steve Jobs. This flawed thinking gives people the idea that technology is the way to be successful.

Since so many people believe that anyone can achieve success through technology, tech has become step one in solving problems–whether or not it’s appropriate.

What Technology Can Actually Do

Using technology for the sake of using technology doesn’t work.

When people grapple with technology without a plan, they fail miserably. Tech doesn’t guarantee greatness. Good ideas stick around, and poorly executed ideas die. Thoughtlessly relying on technology is a liability, not an asset.

Maybe it’s because so much of what makes technology work is unknown to the average person. Perhaps we’ve seen the successes of greats like Mark Zuckerberg without recognizing their struggles. Whatever the case, many of us believe that using technology is the easy answer.

Without having a deep understanding of technology and how it can address a clearly-defined question, the idea will fail every time. Look at The Daily. They knew they wanted to created a newspaper available on the iPad, but they didn’t understand the technology. They created a substandard product that didn’t solve any problems.

Ideas First, Technology Second

Reaching for technology without a clear purpose isn’t going to get you anywhere. Come up with an idea first. Then, if technology is the best way to solve the problem or answer the question, use it.

Technology makes it possible for us to do much more than we could do without it, but it can’t help us decide what to do. It can’t teach us how to ask great research questions. Technology is the tool that you use to solve the problem, but it isn’t the thing that creates the solution.

As long as you get the order right—idea first and tech second— you can achieve success. When you have a clearly-defined issue or concept, then you can adapt technology to accelerate progress.

As you’re coming up with ideas, stay away from using technology just because it’s there. Remember, lead with a great idea, and then follow with technology. Think about the following questions to stay true to your purpose:

What do you want to achieve?

You should have a clear question or goal in mind before you even think about how an app or piece of tech could solve it. For example, imagine you are tired of paying high rates for taxis or chasing down inconvenient public transportation. You need to come up with a better way to get around.

How do you think you can solve the problem without technology?

Does the problem exist because non-tech solutions aren’t helping? In many cases, it’s logical to jump to technology because non-tech solutions haven’t solved the problem. You won’t know unless you do some thinking and research.

When you consider your transportation problem, think about possible solutions. Shuttles, public transportation, and bothering your friends for rides are either inconvenient or expensive. Besides building a more efficient public transportation system, which would require billions in infrastructure, you can’t imagine a solution to this transportation issue without technology.

Focus on the why and how of the problem.

The problem exists because there’s a gap in the service that’s currently available. You have to think about why the gap exists and how you might be able to navigate around it.

Thinking about the transportation issue, you realize that cab companies are subject to lots of regulations. State and local governments may not be able to fund better public transportation. Your friends have better things to do than pick you up all the time. You have to get around the issue somehow.

In this case technology has the power to close the gap. It connects people willing to drive with those who needed rides for a fraction of the cost of a cab. This is how Uber and Lyft came to be.

Technology Is Not the Answer to All

Technology can’t come into play until you’ve thought about your problem from every angle. If you’ve tried other approaches, and they don’t seem to work, then you can think about how to accelerate the process.

Only then is it appropriate to turn to technology. By defining your purpose first, you ensure that you aren’t just reaching for technology because it seems sleek and shiny. It’s actually going to make it easier for you to solve the problem. The tech isn’t the solution. Your ideas bring about the solution. Technology just makes it easier.

Tech is reshaping our world every day. It makes our lives easier and opens possibilities for us. Just because you can use technology doesn’t mean you should turn to it first. Start with your ideas and use technology to support your efforts.

Featured photo credit: Photo by Alex Knight on Unsplash via unsplash.com

Reference

[1]	^	Time: The 20 Most Successful Technology Failures of All Time
[2]	^	Daring Fireball: Why ‘The Daily’ Failed

The post Is Technology the Key to Success in the 21st Century? appeared first on Lifehack.

from Lifehack http://ift.tt/2l6ni7Y
via IFTTT

Read More Add comment

6 Ways In Which 3D Printing Technology Can Save Lives

By 0x000216

Read

0 Comments

3D printing technology is not limited to printing consumer goods and toys. It can also save human lives. This may come as a surprise to many readers, but it is 100% true.

The technology is already saving many lives as you read this post. 3D technology has done a tremendous job in advancing the medical field.

Recently, a child named Lucy Boucher was the first child to have a kidney transplant assisted by 3D printing technology. This technology made the complicated task of transplanting a 35-year-old’s kidney into a 4-year-old child much simpler. You cannot ignore the extra risk involved when a transplant is performed between people so far apart in age. But, 3D printing technology made this possible.

This technology can do wonders. Let me tell you about some of the medical fields in which 3D printing technology is creating marvelous changes.

1. 3D Printed Organs

Using 3D tech, scientists can build organs for the human body. They just need to supply instructions to the computer and raw materials to the 3D printer, and 3D tech will do the rest of the work.

Isn’t this amazing?

If scientists can build organs using these techniques, then surely the organs can be customized according to the individual patient’s needs, producing better results. Automation could make this process even better in the future.

2. Better Medical Imaging

Medical imaging is a core aspect of medical care. Now, scientists and doctors are taking medical imaging to new heights with the help of 3D printing technology.

How does it work?

First, doctors use MRI or CT scanning to make an image of a particular patient or the patient’s organs. Then, they make a dummy patient using the scans and 3D technology. They treat the dummy patient and check for results.

Researchers can then collect those results from many different patients and analyze what treatment produced the best results. In this way, doctors can choose the best possible treatment for the human patient.

A similar technique can be applied in cancer treatment. Doctors can carry out different experiments and analyze patients’ predicted results.

3D dummy patients are also good for teaching purposes. They can help medical students to understand the structures of the human body and to practice with real ease.

3. Improvements in Medical Education

Dummy models are really helpful for medical education. Students can carry out different experiments and techniques on realistic dummies so that they can get experience with realistic scenarios. Not only medical students, but also other students in hands-on fields like engineering or science can benefit. Lots of schools have already implemented this technology.

4. 3D Printed Casts for Broken Bones

You know how painful broken bones are? They take a long time to recover from. And, in some cases, it is quite difficult for the patient to recover full fitness. 3D technology can be handy in this scenario.

Doctors can take X-rays or MRI scans, then build a needed structure that is an exact match for the patient using a 3D printer. This can be helpful for thousands of patients. A cortex exoskeletal cast is one such example. These casts are far better than the traditional casts used for broken bones.

5. Engineering Safer Vehicles with 3D Printing Technology

With the help of 3D technology, riding in many kinds of vehicles will become much safer. Manufacturing safety items is not the easiest task for companies. 3D technology can be really fruitful in designing and building better and safer vehicle parts.

Using the technology, car companies can design, produce, and test different parts at a high rate, then choose the best ones. Airline companies can also use this technology to make air travel safer.

3D printing technology has certainly automated many tasks for humans. We can do things much faster, cheaper, and with greater accuracy. This could be bad for some people, because some may lose their jobs, but we cannot ignore this technology’s rise.

Cheap 3d printers can easily be used to do wonderful things.

The post 6 Ways In Which 3D Printing Technology Can Save Lives appeared first on Lifehack.

from Lifehack http://ift.tt/2kvvdxy
via IFTTT

Read More Add comment

A Monsanto case that could alter the dynamics of technology transfer to India

By 0x000216

Read

0 Comments

The IPKat is delighted to receive this guest post from long time Katfriend and sometime blogger Prashant Reddy (details at the end of the post).

For the last several months Monsanto and Indian seed companies, backed by the Indian government (& state governments) have been locked in a wide-ranging legal dispute over the use of price-control legislation to fix IP licensing fees, the demand for compulsory licences for Monsanto’s patent over its Bt technology, demands by state governments for the outright revocation of Monsanto’s patent over its Bt technology, and an ongoing investigation into Monsanto’s licensing deals.

Before explaining the legal dispute, it may help to first understand the technology involved along with the licensing model adopted by Monsanto in India.

The technology, the patent and the business model

A cotton bollworm larva

The technology in this case is Monsanto’s famous Bt technology, which involves the introgression of certain genes of Bacillus thurgingiensis (Bt), a naturally occurring bacteria, into the genome of cotton seeds in order to ensure the resulting crop’s resistance to certain pests of the lepidopteran species. In specific, Monsanto’s technology is known to act against the Bollworm which is the most atrocious of pests that attacks and destroys the cotton crop. The use of this technology reduces or maybe in some cases even eliminates the pesticides that are required to be used by farmers.

Although the first generation of Bt technology, was never patented by Monsanto in India, the second generation Bt technology licensed under the trademark Bollguard-II variety ® is patented. Monsanto was granted Indian patent 232681 (drawing priority from US 60/297,406) on March 20, 2009 for the “Cotton event Mon 15985 and compositions and methods for detection”. Claim 1 of this patent is for a synthetic DNA molecule, comprising a particular genetic sequence consisting of selected Bt genes which are inserted into the genome of cotton seeds.

As per the entries in the patent register, Monsanto has licensed this patent to its joint-venture in India called the Mahyco Monsanto Biotech (India) Ltd. which has in turn entered into sub-licences with approximately 40 Indian seed companies. These seed companies evolve their own seed varieties, which can be protected under the Protection of Plant Varieties & Farmers Rights Act, 2001 and these seeds are then introgressed with Monsanto’s patented gene technology. Monsanto is paid a royalty for the patented technology, know-how etc. As per Monsanto’s filing with the Patent Office in 2013, it earned an annual revenue of 6.85 billion rupees in that year (Approx. US $110 million dollars in 2013).

Price control over technology licensing fees

A constant complaint against Monsanto from the very beginning has been that its technology licensing fees for Indian seed companies are too high, thereby raising prices for the cotton seeds that are sold to farmers. About a decade ago, Indian state governments successfully applied pressure on Monsanto to reduce the technology licensing fees for its unpatented BG-1 technology. This happened at a time when Monsanto didn’t have any patents in India for its technology.

Over the last few years, the pricing issue has once again come back into focus. This time state governments enacted legislation to control the retail prices of seeds but most have not interfered with the technology license fee charged by Monsanto to seed companies. The Indian seed companies felt the pinch of the price control legislation because, while the states were reducing the retail price of cotton seeds, Monsanto was refusing to reduce its technology licensing fee. Thus the margins of the seed companies were getting squeezed.

All of this changed in December 2015 when the Ministry of Agriculture of Government of India notified the Cotton Seeds Price (Control) Order (CSPO), 2015. This Order derives its authority from the Essential Commodities Act, 1955 – legislation which vests in the government powers to control the prices of a wide range of essential commodities such as drugs, food crops, sugar, foodstuffs etc. for the purpose of securing the “equitable distribution and availability of these commodities at fair prices or for maintaining or increasing supplies of the same”. This legislation is usually used to control the retail price of the commodity in the market. To the best of my knowledge, this legislation has never been used to control the royalty or licensing fee for the use of a patent or technology transfer. Even in the context of drugs, the Drug Price Control Order (DPCO) has always covered only generic drugs despite calls for it to be extended to patented drugs.

The CSPO however makes it expressly clear that while the Government is fixing the maximum retail price of cotton seeds, “it shall also fix and regulate the seed value and license fee including royalty or trait value, if any, that constitute components of the Maximum Sale Price”. The phrase “royalty (trait value)” is defined in the Order as “the amount which the Licensor collects from the Licensee under the License Agreement for granting licence to GM Technology”. Technically this could include even the royalties for know-how or trade secrets not covered by patent. The phrase “GM Technology” itself is defined in the CSPO to specifically include Bt technology.

The interesting question of law thrown up by this case is whether the Essential Commodities Act can be used by the Government of India to control the royalty fees in patented technology when the Patents Act, 1970 specifically provides for a mechanism, involving compulsory licences, to help reduce the prices of patented technologies if it is in public interest. Monsanto and its Indian subsidiaries have already challenged this order before the Delhi High Court and the determination of this dispute by the Delhi High Court will have a direct implication on the price control of patented pharmaceuticals – which is a far more explosive an issue than cotton seeds. The larger implication of course is on future technology licensing deals with Indian parties. Any decision by the Delhi High Court to uphold the CPSO would mean that the Government of India, and in some cases even State Governments, could intervene to regulate technology licensing fees between two private parties.

The demand to issue compulsory licences

Earlier this month, the Indian media had reported that the Government of Andhra Pradesh, a major cotton growing state in South India (& home to the largest Indian seed companies), has written to the Government of India asking it to invoke its powers under Section 92 of the Patents Act to issue compulsory licences for Monsanto’s patent on the grounds that “Monsanto is having a monopoly and through one-sided sub-licence agreements is completely controlling all the cotton seed firms and, thereby, collecting excessive royalties”. Section 92 is a provision which states that the Central Government may in cases of a national emergency or in case of extreme urgency or in case of public non-commercial use, make a declaration that a certain patent will be available for compulsory licensing. This provision is different from Section 84, under which Bayer’s patent was compulsory licensed to Natco, an Indian company. Under Section 84, the burden of proof is on the person seeking a CL and it is not easy to establish the threshold for the grant of a CL. This threshold includes unreasonable prices, unavailability of the patented commodity etc. However under Section 92, once the govt. makes a determination that a CL needs to be granted, third parties are relieved of the burden of establishing the threshold required under Section 84. They are then only required to make an application the Controller of Patents who is required to grant a compulsory licence on certain terms and conditions determined by him.

In 2013, the Central Government was seriously considering the possibility of invoking Section 92 for 3 cancer drugs: Herceptin, Dastinib and Ixabepilone. The Indian Government never went through with the threat and no CLs were ever issued. Whether the Government of India acts on this request from the Government of Andhra Pradesh remains to be seen.

Revocation request under Section 66

The Government of Andhra Pradesh has apparently also requested the Government of India to revoke Monsanto’s patent under Section 66 of the Patents Act. This is a provision which allows the Central Government to revoke patents in ‘public interest’ if the Government is of the opinion that “a patent or the mode in which it is exercised is mischievous to the State or generally prejudicial to the public”. The patentee is given a hearing after which the Government is only required to publish a declaration in the Official Gazette revoking the patent. This provision has been used twice in the past. The first such revocation was in 1994, of a patent granted to Agracetus, for a method to genetically modify cotton cells. The second such revocation, in 2013, was of a patent belonging to Indian company Avesthagen because it allegedly claimed traditional knowledge. The Traditional Knowledge Digital Library (TKDL) had challenged the European equivalent of the patent (which had in any case been objected to by the EPO) but had not opposed the equivalent Indian patent. Once this was reported on SpicyIP, the Indian Government used its powers under Section 66 to revoke the patent. It is quite unlikely that the Government of India will use these powers under Section 66 because the provision isn’t exactly TRIPS compliant and any action under this provision is likely to stir controversy on the international stage.

The lawsuits before the Bombay and Delhi High Courts & the inevitable question on gene patents

Since late last year there has been a virtual explosion of litigation between MMBL and the Indian seed companies. The first series of litigation kicked of last year after 8 of the largest Indian seed companies refused to pay MMBL outstanding royalties of approximately four billion rupees. The refusal was triggered by the fact that state governments were clamping down on the retail prices of cotton seeds under price control legislation and MMBL was refusing to reduce its technology licensing fee. As a result the Indian seed companies were faced with squeezed margins. In retaliation to the non-payment of royalties, MMBL terminated the licensing agreements, initiated arbitration proceedings before the Bombay High Court and infringement proceedings before the Delhi High Court. As per recent reports, Monsanto and its group companies have instituted trademark infringement proceedings before the Delhi High Court against Nuziveedu Seeds Ltd. The court order is unavailable but according to the news reports the court passed interim orders restraining Nuziveedu from selling the seeds manufactured after November 2015 and the company was also ordered to pay Monsanto the royalties on the existing stock. It isn’t clear how the High Court issued such interim orders for damages before trial. Due to a new law governing commercial litigation in India, such interim orders cannot be appealed – only final judgments can be appealed.

Also inevitable in this series of litigation is a challenge to Monsanto’s patent – to the best of my knowledge, gene patents have never been litigated in India. If Nunziveedu Seeds Ltd. decides to challenge the validity of Monsanto’s patent any resulting litigation will be high-profile because Monsanto is one of those companies that everybody loves to hate in India.

The Competition Commission investigation

In addition to all of the above, the Competition Commission of India (CCI) has recently ordered an investigation into MMBL’s licensing deals, after receiving a reference from the Ministry of Agriculture and a separate complaint from Nuziveedu Seeds Ltd. MMBL is Monsanto India’s JV which licences the patent in question from Monsanto Technology LLC (USA) and then in turn sub-licences the technology to over 40 Indian seed companies.

The procedure before the CCI is two-fold. At the first stage, the CCI determines whether there exists a prima faciecase of violation of the Competition Act and if it does make such a determination, an investigation will be conducted by the Director General’s office, after which a hearing is conducted on the merits and a ruling is delivered. If no prima facie case is made out the complaint is dismissed.

In this particular case, the CCI has found that MMBL is prima facie in a dominant position in the relevant product market (identified as the provision of Bt cotton technology in the upstream and manufacture and sale of Bt cotton seeds in India in the downstream) and the relevant geographical area (identified as the entire country of India). While there is no denying that MMBL has virtually 99% of the market share, the issue of dominance should be judged by the ability of MMBL to operate independently of competitive forces prevailing in the market. In other words, if the market offers alternatives whereby the downstream player is able to substitute MMBL’s technology or survive without MMBL’s technology, the company should not be found to be the dominant player.

In this case, it is entirely possible to manufacture cotton seeds without Bt technology, except the farmers planting these seeds will have to use pesticides to tackle the Boll Worm. Prior to 2001, Indian farmers were growing cotton without the Bt technology. MMBL’s technology is therefore substitutable. Further, even with regard to Bt technology, MMBL has been licensed a patent for only one particular gene sequence – its competitors can still use the old Bt technology which is not patented or innovate to create new GM hybrids. In fact, recent news reports indicate that the publicly funded Central Institute for Cotton Research (CICR) has begun field trials with 21 different varieties of cotton seeds which have been introgressed with Bt technology. In either case, the CCI should have interpreted the scope of MMBL’s patent and analysed whether competitors were completely precluded from entering the market. Unfortunately there is no such discussion in the order.

After finding that MMBL had a dominant position, the CCI also found that the company was abusing its dominant position because the termination conditions imposed by MMBL in its licences were allegedly unreasonable and beyond what was required to legitimately protect its IP rights. One of the termination conditions imposed a requirement to inform MMBL within 30 days if the licensee was developing hybrid cotton seeds with technology derived from MMBL’s competitors. Other conditions required that once a termination notice was served, the licensee immediately stop selling the seeds in question followed by destroying the seeds in existence and also destroying all the parent lines. An additional condition allowed MMBL to terminate the sub-licence if any law was enacted to restrict the technology licensing fee. The CCI also accepted the allegation that MMBL may have terminated the licenses with the informant in order to protect its presence in the downstream market i.e. the seed markets in which its group companies were involved. The imposition of such restrictive conditions along with the suspicion that MMBL was influencing the downstream market through its group companies led to a preliminary, prima facie finding of abuse of Monsanto’s dominant position.

Once again, the above reasoning isn’t clear. The termination conditions which the CCI finds to be an ‘abuse’ are basically the boiler-plate clauses in any technology transfer contract and are the industry standard. Further the allegation that MMBL was terminating the licenses of companies like Nuziveedu just to protect its group companies isn’t really tenable – the 8 sub-licenses were terminated by MMBL because of non-payment. Besides, there are approximately 32 other sub-licensees for the technology – so there is considerable competition in the downstream market. Unfortunately, the CCI’s analysis does not cover any of these issues. Hopefully the investigation by the Director General will bring out these points in more detail.

In addition to the preliminary finding of abuse of dominant position, the CCI also made a preliminary finding that the licensing agreements were themselves anti-competitive in nature because of the stringent termination conditions discussed above. In the Commission’s words “The termination conditions are found to be excessively harsh and do not appear to be reasonable as may be necessary for protecting any of the IPR rights, as envisaged under Section 3(5) of the Act. Such agreements discourage and serve as a major deterrent for the sub licensee from exploring dealing with competitors.” This reasoning is simply not convincing because such conditions are part and parcel of any tech-transfer deal. Hopefully the investigation by the Director General will do a better job.

Notwithstanding that the CCI’s findings are only preliminary – MMBL’s stock tanked 4% after the announcement of the investigation. The manner in which the Indian judiciary and regulators deal with the issues raised in this case is going to have a profound influence on the manner in which technology is transferred to Indian companies in the future.

For a bit of history on this post, do read my earlier post on SpicyIP over here.

The writer is an Indian lawyer. He can be contacted at preddy85@gmail.com

Read More Add comment

Unlock a More Efficient and Liberal State With Blockchain: UK MP

By 0x000216

Read

0 Comments

Blockchain technology offers an unrivaled opportunity for the UK to redesign its data systems. The state should therefore focus on implementing blockchain technology to increase efficiency, save on costs, and rebuild societal trust. This is according to a report by Eddie Hughes, the Member of Parliament representing Walsall North in the UK. The comprehensive report looked at the numerous opportunities presented by blockchain in various sectors of the economy including finance, supply chain management, and healthcare. Using Estonia’s foray into distributed ledger technologies for governance as its basis, it made recommendations to the UK government regarding how best to implement blockchain tech and detailed the many opportunities doing so could unlock.

Rebuilding Societal Trust

One of the key benefits of blockchain technology is that it gives people back control over their data, the report, which was published on July 4, stated. In a world where data is becoming increasingly important but is controlled by a handful of companies, blockchain technology could liberate and empower the people. The application of this technology will also make government operations and processes more transparent, which will boost people’s trust in the government. According to Hughes, people have increasingly lost trust in the government in the wake of scandals involving theft and misuse of public resources as well as harassment of charity workers. Blockchain technology can help the government rebuild this trust.

The report also looked at the benefits that the application of blockchain technology would bring to the UK. The first is that it provides traceability and provenance. All transactions and records held on the blockchain are immutable, which makes it possible to account for every asset. This eliminates the need for expensive auditing of government departments. Its immutability also gives people confidence that records can’t be manipulated, which eliminates the possibility of fraudulent and corrupt dealings. Being a peer-to-peer technology, it reduces costs significantly and fosters trust between transacting parties. Smart contracts, introduced by Ethereum, also provide a great opportunity to automate processes and reduce costs by eliminating middlemen.

Hughes used Estonia as an example of a country that has applied blockchain technology with much success. The Baltic state implemented blockchain technology in 2012 in its security, health, legislative, judicial, and commercial code systems after allegedly having begun testing the technology as far back as 2008. Estonia has been very successful in its implementation of blockchain technology, with 99 percent of its government services being linked through X Road, an interoperability platform underpinned by blockchain technology. According to the Estonian government, the digitization of most platforms and the instant exchange of data with minimal human assistance save the country 820 years’ worth of work annually. While there are some aspects of the Estonian blockchain that can’t be implemented in the UK due to differences in privacy laws, Hughes expressed confidence that most of the applications would offer untapped opportunities in the UK.

The report also recognized various government agencies in the UK that have recently taken on blockchain technology. In April, the Secretary of State for Media and Culture was full of praise for blockchain technology at the London Blockchain Conference. He said that the technology would make the government more efficient and that there was real interest in blockchain from many departments including DFID, the Ministry of Justice, and the Department for Energy and Industrial Strategy.

Hughes called on the government to take leadership in the development of blockchain solutions and to stay ahead of the game. To start with, he wrote, every government department should aim to increase its efficiency by 1 percent by using blockchain technology. This target, while small, is realistic and would give these departments time to adjust to the new technology. With total government expenditures for 2017-2018 expected to be £800 billion, a 1 percent savings would amount to £8 billion. The report ended by recommending strategies that the government could use to ensure that the application of blockchain technology is seamless and effective, one of which is setting up an international blockchain competition. Such a competition, Hughes believes, would entice leading global blockchain companies to develop solutions geared toward the UK market and would drive innovation in the country.

by Steve Kaaru via NullTX

Read More Add comment

VMware Workstation Technology Preview July 2014

By 0x000216

Read

0 Comments

The VMware Workstation team is providing public access to the latest VMware Workstation Technology Preview July 2014. This Tech Preview adds new features not included in the prior May 2014 Technology Preview in addition to general stability, application compatibility and usability improvements. The VMware Workstation Technology Preview includes changes to the core virtualization engine and […]]> The VMware Workstation team is providing public access to the latest VMware Workstation Technology Preview July 2014. This Tech Preview adds new features not included in the prior May 2014 Technology Preview in addition to general stability, application compatibility and usability improvements. The VMware Workstation Technology Preview includes changes to the core virtualization engine and new capabilities we are exploring.

We would appreciate feedback in the following areas:

New OS support including the latest versions of Windows, Ubuntu, Fedora, RHEL and OpenSUSE

VMware Hardware Version 11 including improved CPU support and upgraded USB 3.0 controller

Graphics memory configuration per virtual machine

Windows 8 Unity mode improvements

Create and boot virtual machine with EFI

Experimental performance tuning for VM suspend and resume

The VMware Workstation Technology Preview July 2014 is available to download HERE via our VMware Workstation Community. More details including installation instructions can be found on the What’s New page.

As with the prior Technology Preview May 2014, please post all of your feedback in the VMware Workstation Technology Preview 2014 community forum. Our Developers, Quality Assurance Engineers, Support Teams, Technical Writers, Product Marketing and Product Managers are all actively involved in the forums to ensure that your suggestions and comments get our attention.

Thank you!

The VMware Workstation Team

via VMware Blogs http://bit.ly/1xEN7v1 The VMware Workstation team is providing public access to the latest VMware Workstation Technology Preview July 2014. This Tech Preview adds new features not included in the prior May 2014 Technology Preview in addition to general stability, application compatibility and usability improvements. The VMware Workstation Technology Preview includes changes to the core virtualization engine and […]]> The VMware Workstation team is providing public access to the latest VMware Workstation Technology Preview July 2014. This Tech Preview adds new features not included in the prior May 2014 Technology Preview in addition to general stability, application compatibility and usability improvements. The VMware Workstation Technology Preview includes changes to the core virtualization engine and new capabilities we are exploring.

We would appreciate feedback in the following areas:

New OS support including the latest versions of Windows, Ubuntu, Fedora, RHEL and OpenSUSE

VMware Hardware Version 11 including improved CPU support and upgraded USB 3.0 controller

Graphics memory configuration per virtual machine

Windows 8 Unity mode improvements

Create and boot virtual machine with EFI

Experimental performance tuning for VM suspend and resume

Thank you!

The VMware Workstation Team

Read More Add comment

SB19-021: Vulnerability Summary for the Week of January 14, 2019

By 0x000216

Read

0 Comments

Original release date: January 21, 2019 | Last revised: January 22, 2019

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0
Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9
Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

The NCCIC Weekly Vulnerability Summary Bulletin is created using information from the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD). In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

High Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
apple -- apple_tv	In iOS before 11.2.5, macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, watchOS before 4.2.2, and tvOS before 11.2.5, a memory corruption issue exists and was addressed with improved memory handling.	2019-01-11	10.0	CVE-2018-4189 CONFIRM MISC MISC MISC
apple -- apple_tv	In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a permissions issue existed in Remote Management. This issue was addressed through improved permission validation.	2019-01-11	10.0	CVE-2018-4298 CONFIRM MISC
apple -- iphone_os	In iOS before 9.3.3, a memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.	2019-01-11	9.3	CVE-2016-7576 CONFIRM
apple -- mac_os_x	In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a logic error existed in the validation of credentials. This was addressed with improved credential validation.	2019-01-11	7.5	CVE-2017-13889 CONFIRM
apple -- mac_os_x	In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, an out-of-bounds read was addressed with improved input validation.	2019-01-11	10.0	CVE-2018-4169 CONFIRM
apple -- mac_os_x	In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS.	2019-01-11	7.2	CVE-2018-4182 MISC CONFIRM DEBIAN
apple -- mac_os_x	In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions.	2019-01-11	7.2	CVE-2018-4183 MISC CONFIRM DEBIAN
apple -- mac_os_x	In macOS High Sierra before 10.13.5, an input validation issue existed in the kernel. This issue was addressed with improved input validation.	2019-01-11	10.0	CVE-2018-4254 CONFIRM
apple -- mac_os_x	In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved size validation.	2019-01-11	10.0	CVE-2018-4257 CONFIRM
apple -- mac_os_x	In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved bounds checking.	2019-01-11	10.0	CVE-2018-4258 CONFIRM
icmsdev -- icms	An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php _data_id parameter.	2019-01-14	7.5	CVE-2019-6259 MISC
mailenable -- mailenable	MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.	2019-01-16	7.5	CVE-2015-9277 MISC MISC MISC
oracle -- retail_xstore_payment	Vulnerability in the Oracle Retail Xstore Payment component of Oracle Retail Applications (subcomponent: Security). The supported version that is affected is 3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Payment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Payment accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Xstore Payment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Xstore Payment. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).	2019-01-16	7.5	CVE-2018-3311 CONFIRM BID
oracle -- solaris	Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	7.8	CVE-2019-2437 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	7.8	CVE-2019-2511 CONFIRM BID
skymoonlabs -- cleanto	Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter.	2019-01-15	7.5	CVE-2019-6295 MISC
skymoonlabs -- cleanto	Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter.	2019-01-15	7.5	CVE-2019-6296 MISC

Medium Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
apple -- apple_tv	In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, proxy authentication incorrectly reported HTTP proxies received credentials securely. This issue was addressed through improved warnings.	2019-01-11	4.3	CVE-2016-4642 MISC MISC CONFIRM
apple -- apple_tv	In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a validation issue existed in the parsing of 407 responses. This issue was addressed through improved response validation.	2019-01-11	4.0	CVE-2016-4643 MISC MISC CONFIRM
apple -- apple_tv	In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials.	2019-01-11	4.0	CVE-2016-4644 MISC MISC CONFIRM
apple -- apple_tv	In iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, an array indexing issue existed in the handling of a function in javascript core. This issue was addressed with improved checks.	2019-01-11	6.8	CVE-2018-4210 GENTOO MISC MISC MISC CONFIRM UBUNTU
apple -- apple_tv	In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.	2019-01-11	6.8	CVE-2018-4212 GENTOO MISC CONFIRM MISC MISC MISC MISC UBUNTU
apple -- apple_tv	In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.	2019-01-11	6.8	CVE-2018-4213 GENTOO MISC CONFIRM MISC MISC MISC UBUNTU
apple -- apple_tv	In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issues were addressed with improved memory handling.	2019-01-11	6.8	CVE-2018-4262 SECTRACK GENTOO MISC CONFIRM MISC UBUNTU
apple -- apple_tv	In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sierra before 10.13.6, a spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.	2019-01-11	5.0	CVE-2018-4277 SECTRACK MISC MISC MISC CONFIRM MISC
apple -- apple_tv	In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.	2019-01-11	4.3	CVE-2018-4278 SECTRACK MISC GENTOO CONFIRM MISC MISC MISC MISC UBUNTU
apple -- icloud	In iCloud for Windows before 7.3, Safari before 11.0.3, iTunes before 12.7.3 for Windows, and iOS before 11.2.5, multiple memory corruption issues exist and were addressed with improved memory handling.	2019-01-11	6.8	CVE-2018-4147 CONFIRM MISC MISC MISC MISC
apple -- iphone_os	In iOS before 11.2, a type confusion issue was addressed with improved memory handling.	2019-01-11	5.0	CVE-2017-13888 CONFIRM
apple -- iphone_os	In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management.	2019-01-11	4.3	CVE-2017-13891 CONFIRM
apple -- iphone_os	In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for exchange rates.	2019-01-11	4.3	CVE-2017-2411 CONFIRM
apple -- mac_os_x	In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.	2019-01-11	4.9	CVE-2018-4181 MLIST CONFIRM UBUNTU DEBIAN
apple -- mac_os_x	In macOS High Sierra before 10.13.5, a privacy issue in the handling of Open Directory records was addressed with improved indexing.	2019-01-11	5.0	CVE-2018-4217 CONFIRM
cairographics -- cairo	An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.	2019-01-16	4.3	CVE-2019-6461 MISC MISC
cairographics -- cairo	An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.	2019-01-16	4.3	CVE-2019-6462 MISC MISC
castlamp -- zenbership	Zenbership v107 has CSRF via admin/cp-functions/event-add.php.	2019-01-15	6.8	CVE-2016-10738 EXPLOIT-DB
cisco -- identity_services_engine_software	A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient sanitization of user-supplied data that is written to log files and displayed in certain web pages of the web-based management interface of an affected device. An attacker could exploit this vulnerability by convincing a user of the interface to click a specific link or view an affected log file. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.	2019-01-15	4.3	CVE-2018-15440 BID CISCO
cisco -- identity_services_engine_software	A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some parameters passed to the web-based management interface of an affected device. An attacker could exploit this vulnerability by convincing a user of the interface to click a specific link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.	2019-01-15	4.3	CVE-2018-15463 BID CISCO
citysearch_/_hotfrog_/_gelbeseiten_clone_script_project -- citysearch_/_hotfrog_/_gelbeseiten_clone_script	PHP Scripts Mall Citysearch / Hotfrog / Gelbeseiten Clone Script 2.0.1 has Reflected XSS via the srch parameter, as demonstrated by restaurants-details.php.	2019-01-12	4.3	CVE-2019-6248 MISC
easycms -- easycms	An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI.	2019-01-15	6.8	CVE-2019-6294 MISC
frog_cms_project -- frog_cms	Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).	2019-01-11	4.3	CVE-2019-6243 MISC
gnu -- recutils	An issue was discovered in GNU Recutils 1.8. There is a double-free problem in the function rec_mset_elem_destroy() in the file rec-mset.c.	2019-01-16	4.3	CVE-2019-6455 MISC
gnu -- recutils	An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_fex_size() in the file rec-fex.c of librec.a.	2019-01-16	4.3	CVE-2019-6456 MISC
gnu -- recutils	An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_aggregate_reg_new in rec-aggregate.c in librec.a.	2019-01-16	4.3	CVE-2019-6457 MISC
gnu -- recutils	An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_buf_new in rec-buf.c when called from rec_parse_rset in rec-parser.c in librec.a.	2019-01-16	4.3	CVE-2019-6458 MISC
gnu -- recutils	An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_extract_type in rec-utils.c in librec.a.	2019-01-16	4.3	CVE-2019-6459 MISC
gnu -- recutils	An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_field_set_name() in the file rec-field.c in librec.a.	2019-01-16	4.3	CVE-2019-6460 MISC
hucart -- hucart	An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/index.php?load=admins&act=edit_info&act_type=add.	2019-01-13	6.8	CVE-2019-6249 MISC EXPLOIT-DB
ibm -- security_identity_manager	IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628.	2019-01-14	5.0	CVE-2018-1956 BID XF CONFIRM
ibm -- security_identity_manager	IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153748.	2019-01-14	4.3	CVE-2018-1967 BID XF CONFIRM
ibm -- security_identity_manager	IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 153750.	2019-01-14	6.5	CVE-2018-1969 BID XF CONFIRM
joomla -- joomla!	An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.	2019-01-16	4.3	CVE-2019-6261 BID CONFIRM
joomla -- joomla!	An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability.	2019-01-16	4.3	CVE-2019-6264 BID CONFIRM
libpng -- libpng	png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp.	2019-01-11	6.8	CVE-2019-6129 MISC
libtiff -- libtiff	The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.	2019-01-11	6.8	CVE-2019-6128 MISC
mailenable -- mailenable	MailEnable before 8.60 allows Stored XSS via malformed use of "" character in the body of an e-mail message.	2019-01-16	4.3	CVE-2015-9279 MISC MISC MISC
mailenable -- mailenable	MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.	2019-01-16	5.0	CVE-2015-9280 MISC MISC MISC
microsoft -- team_foundation_server	An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.	2019-01-17	4.0	CVE-2019-0647 BID CONFIRM
oracle -- application_testing_suite	Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Load Testing for Web Apps). Supported versions that are affected are 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing Suite. CVSS 3.0 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).	2019-01-16	6.4	CVE-2018-3304 CONFIRM BID
oracle -- application_testing_suite	Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Load Testing for Web Apps). Supported versions that are affected are 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data as well as unauthorized read access to a subset of Oracle Application Testing Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing Suite. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).	2019-01-16	6.5	CVE-2018-3305 CONFIRM BID
oracle -- argus_safety	Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Console). Supported versions that are affected are 8.1 and 8.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Argus Safety. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Argus Safety accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).	2019-01-16	4.0	CVE-2019-2430 CONFIRM BID
oracle -- argus_safety	Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Console). Supported versions that are affected are 8.1 and 8.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Argus Safety. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Argus Safety, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Argus Safety accessible data. CVSS 3.0 Base Score 6.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N).	2019-01-16	4.3	CVE-2019-2431 CONFIRM BID
oracle -- argus_safety	Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Login). Supported versions that are affected are 8.1 and 8.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Argus Safety. While the vulnerability is in Oracle Argus Safety, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Argus Safety accessible data as well as unauthorized read access to a subset of Oracle Argus Safety accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).	2019-01-16	4.9	CVE-2019-2432 CONFIRM BID
oracle -- content_manager	Vulnerability in the Oracle Content Manager component of Oracle E-Business Suite (subcomponent: Cover Letter). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Content Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Content Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Content Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Content Manager accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).	2019-01-16	5.8	CVE-2019-2445 CONFIRM BID
oracle -- database	Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).	2019-01-16	6.5	CVE-2019-2406 CONFIRM BID
oracle -- database	Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 18c. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).	2019-01-16	4.4	CVE-2019-2444 CONFIRM BID
oracle -- e-business_suite	Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Messages). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).	2019-01-16	4.3	CVE-2019-2396 CONFIRM BID
oracle -- e-business_suite	Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Session Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).	2019-01-16	5.0	CVE-2019-2488 CONFIRM BID
oracle -- e-business_suite	Vulnerability in the Oracle Email Center component of Oracle E-Business Suite (subcomponent: Message Display). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Email Center accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).	2019-01-16	4.3	CVE-2019-2491 CONFIRM BID
oracle -- e-business_suite	Vulnerability in the Oracle Email Center component of Oracle E-Business Suite (subcomponent: Message Display). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Email Center accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).	2019-01-16	4.3	CVE-2019-2492 CONFIRM BID
oracle -- e-business_suite	Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Messages). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).	2019-01-16	4.3	CVE-2019-2496 CONFIRM BID
oracle -- e-business_suite	Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Messages). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).	2019-01-16	5.8	CVE-2019-2497 CONFIRM BID
oracle -- e-business_suite	Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: SQL Extensions). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Manager accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).	2019-01-16	4.3	CVE-2019-2546 CONFIRM BID
oracle -- enterprise_manager_base_platform	Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponent: EM Console). Supported versions that are affected are 13.2 and 13.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Enterprise Manager Base Platform accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).	2019-01-16	6.4	CVE-2018-3303 CONFIRM BID
oracle -- hospitality_cruise_shipboard_property_management_system	Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: SPMS Suite). The supported version that is affected is 8.0.8. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise Shipboard Property Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Cruise Shipboard Property Management System as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 7.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H).	2019-01-16	4.9	CVE-2019-2411 CONFIRM BID
oracle -- hospitality_reporting_and_analytics	Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker having Admin privilege with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).	2019-01-16	5.5	CVE-2019-2401 CONFIRM BID
oracle -- hospitality_reporting_and_analytics	Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).	2019-01-16	6.4	CVE-2019-2425 CONFIRM BID
oracle -- hospitality_simphony	Vulnerability in the Oracle Hospitality Simphony component of Oracle Food and Beverage Applications. The supported version that is affected is 2.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Simphony accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Simphony. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L).	2019-01-16	6.8	CVE-2019-2402 CONFIRM BID
oracle -- hospitality_simphony	Vulnerability in the Oracle Hospitality Simphony component of Oracle Food and Beverage Applications. The supported version that is affected is 2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data as well as unauthorized read access to a subset of Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).	2019-01-16	6.4	CVE-2019-2403 CONFIRM BID
oracle -- http_server	Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).	2019-01-16	4.6	CVE-2019-2414 CONFIRM BID
oracle -- hyperion_bi+	Vulnerability in the Hyperion BI+ component of Oracle Hyperion (subcomponent: Foundation UI & Servlets). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion BI+. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion BI+ accessible data as well as unauthorized read access to a subset of Hyperion BI+ accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Hyperion BI+. CVSS 3.0 Base Score 4.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L).	2019-01-16	6.0	CVE-2019-2415 CONFIRM BID
oracle -- jdk	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).	2019-01-16	4.3	CVE-2019-2422 CONFIRM BID CONFIRM
oracle -- jdk	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).	2019-01-16	4.3	CVE-2019-2426 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2420 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2434 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).	2019-01-16	5.5	CVE-2019-2436 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2455 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2481 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: PS). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2482 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2486 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2494 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2495 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2502 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2507 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2510 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2528 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2529 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2530 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2531 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2532 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).	2019-01-16	4.0	CVE-2019-2533 CONFIRM CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).	2019-01-16	5.5	CVE-2019-2534 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2537 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	4.0	CVE-2019-2539 CONFIRM BID CONFIRM
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H).	2019-01-16	5.8	CVE-2019-2429 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).	2019-01-16	6.4	CVE-2019-2456 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2019-01-16	5.0	CVE-2019-2457 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2019-01-16	5.0	CVE-2019-2458 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2019-01-16	5.0	CVE-2019-2459 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2019-01-16	5.0	CVE-2019-2460 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2019-01-16	5.0	CVE-2019-2461 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L).	2019-01-16	6.4	CVE-2019-2462 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).	2019-01-16	6.4	CVE-2019-2463 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).	2019-01-16	5.0	CVE-2019-2464 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).	2019-01-16	5.0	CVE-2019-2465 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).	2019-01-16	5.0	CVE-2019-2466 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	5.0	CVE-2019-2467 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	5.0	CVE-2019-2468 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H).	2019-01-16	5.8	CVE-2019-2469 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2019-01-16	5.0	CVE-2019-2472 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	5.0	CVE-2019-2473 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	5.0	CVE-2019-2474 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	5.0	CVE-2019-2475 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	5.0	CVE-2019-2476 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	5.0	CVE-2019-2477 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2019-01-16	5.0	CVE-2019-2478 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	5.0	CVE-2019-2479 CONFIRM BID
oracle -- outside_in_technology	Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2019-01-16	5.0	CVE-2019-2480 CONFIRM BID
oracle -- peoplesoft_enterprise	Vulnerability in the PeopleSoft Enterprise SCM eProcurement component of Oracle PeopleSoft Products (subcomponent: Manage Requisition Status). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise SCM eProcurement, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM eProcurement accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2019-01-16	5.8	CVE-2019-2519 CONFIRM BID
oracle -- peoplesoft_enterprise_cost_center_common_application_objects	Vulnerability in the PeopleSoft Enterprise CC Common Application Objects component of Oracle PeopleSoft Products (subcomponent: Form and Approval Builder). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise CC Common Application Objects, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data. Note: This Enterprise Common Component is used by all PeopleSoft Application products. Please refer to the 4.9	CVE-2019-2419 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).	2019-01-16	5.0	CVE-2019-2404 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Security). Supported versions that are affected are 8.55, 8.56 and 8.57. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).	2019-01-16	6.0	CVE-2019-2405 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Feeds). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).	2019-01-16	4.3	CVE-2019-2408 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Application Server). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).	2019-01-16	6.5	CVE-2019-2416 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).	2019-01-16	6.4	CVE-2019-2417 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Search). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2019-01-16	5.8	CVE-2019-2423 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: XML Publisher). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).	2019-01-16	6.5	CVE-2019-2433 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2019-01-16	5.8	CVE-2019-2439 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Core). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2019-01-16	5.8	CVE-2019-2442 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: XML Publisher). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).	2019-01-16	6.5	CVE-2019-2443 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2019-01-16	5.8	CVE-2019-2471 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Panel Processor). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).	2019-01-16	4.3	CVE-2019-2490 CONFIRM BID
oracle -- peoplesoft_enterprise_peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Search Functionality). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2019-01-16	5.8	CVE-2019-2499 CONFIRM BID
oracle -- primavera_p6_enterprise_project_portfolio_management	Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7-17.12 and 18.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).	2019-01-16	4.0	CVE-2019-2512 CONFIRM BID
oracle -- reports_developer	Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data as well as unauthorized read access to a subset of Oracle Reports Developer accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2019-01-16	5.8	CVE-2019-2413 CONFIRM BID EXPLOIT-DB
oracle -- retail_merchandising_system	Vulnerability in the Oracle Retail Merchandising System component of Oracle Retail Applications (subcomponent: Security (SQL Logger)). The supported version that is affected is 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising System. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Merchandising System accessible data as well as unauthorized read access to a subset of Oracle Retail Merchandising System accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).	2019-01-16	6.4	CVE-2018-3125 CONFIRM BID
oracle -- sun_zfs_storage_appliance_kit	Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Object Store). The supported version that is affected is prior to 8.8.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Sun ZFS Storage Appliance Kit (AK) executes to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).	2019-01-16	4.4	CVE-2019-2412 CONFIRM BID
oracle -- transportation_management	Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: UI Infrastructure). Supported versions that are affected are 6.3.7, 6.4.1, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Transportation Management accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).	2019-01-16	4.0	CVE-2019-2487 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.6	CVE-2018-3309 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.6	CVE-2019-2500 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).	2019-01-16	4.9	CVE-2019-2508 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).	2019-01-16	4.9	CVE-2019-2509 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.4	CVE-2019-2520 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.4	CVE-2019-2521 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.4	CVE-2019-2522 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.4	CVE-2019-2523 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.6	CVE-2019-2524 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.4	CVE-2019-2526 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).	2019-01-16	4.6	CVE-2019-2548 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).	2019-01-16	4.6	CVE-2019-2552 CONFIRM BID
oracle -- web_cache	Vulnerability in the Oracle Web Cache component of Oracle Fusion Middleware (subcomponent: ESI/Partial Page Caching). The supported version that is affected is 11.1.1.9.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Cache. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Cache, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Cache accessible data as well as unauthorized update, insert or delete access to some of Oracle Web Cache accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).	2019-01-16	4.0	CVE-2019-2438 CONFIRM BID
oracle -- webcenter_portal	Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: WebCenter Spaces Application). Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Portal accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).	2019-01-16	5.0	CVE-2019-2427 CONFIRM BID
oracle -- weblogic_server	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).	2019-01-16	5.5	CVE-2019-2395 CONFIRM BID
oracle -- weblogic_server	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Deployment). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).	2019-01-16	4.0	CVE-2019-2398 CONFIRM BID
oracle -- weblogic_server	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L).	2019-01-16	6.8	CVE-2019-2418 CONFIRM BID
oracle -- weblogic_server	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Application Container - JavaEE). The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).	2019-01-16	5.0	CVE-2019-2441 CONFIRM BID
oracle -- weblogic_server	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H).	2019-01-16	6.5	CVE-2019-2452 CONFIRM BID
premiumwpsuite -- easy_redirect_manager	The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI.	2019-01-14	4.3	CVE-2019-6267 MISC MISC MISC
shopware -- shopware	Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.	2019-01-15	6.5	CVE-2018-20713 MISC
tiki -- tikiwiki_cms/groupware	In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.	2019-01-15	6.5	CVE-2018-20719 MISC

Low Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
apple -- mac_os_x	In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.	2019-01-11	2.1	CVE-2018-4255 CONFIRM
apple -- mac_os_x	In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.	2019-01-11	2.1	CVE-2018-4256 CONFIRM
cacti -- cacti	A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.	2019-01-16	3.5	CVE-2018-20723 MISC MISC MISC
cacti -- cacti	A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.	2019-01-16	3.5	CVE-2018-20724 MISC MISC MISC
cacti -- cacti	A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.	2019-01-16	3.5	CVE-2018-20725 MISC MISC MISC
cacti -- cacti	A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.	2019-01-16	3.5	CVE-2018-20726 MISC MISC MISC
cubecart -- cubecart	CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string.	2019-01-13	3.5	CVE-2018-20703 MISC
ibm -- spss_analytic_server	IBM SPSS Analytic Server 3.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148689.	2019-01-15	3.5	CVE-2018-1772 BID XF CONFIRM
joomla -- joomla!	An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration helpurl settings allowed stored XSS.	2019-01-16	3.5	CVE-2019-6262 BID CONFIRM
joomla -- joomla!	An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.	2019-01-16	3.5	CVE-2019-6263 BID CONFIRM EXPLOIT-DB
jpress -- jpress	XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option.	2019-01-14	3.5	CVE-2019-6278 MISC
oracle -- database_server	Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java VM. CVSS 3.0 Base Score 3.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L).	2019-01-16	3.5	CVE-2019-2547 CONFIRM BID
oracle -- hospitality_cruise_shipboard_property_management_system	Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: SPMS Suite). The supported version that is affected is 8.0.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise Shipboard Property Management System executes to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise Shipboard Property Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Cruise Shipboard Property Management System as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data and unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H).	2019-01-16	3.3	CVE-2019-2409 CONFIRM BID
oracle -- hospitality_cruise_shipboard_property_management_system	Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: DGS RES Online, FMS Sender, FMS Receiver, OHC WPF Security). The supported version that is affected is 8.0.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Cruise Shipboard Property Management System executes to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 5.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).	2019-01-16	3.6	CVE-2019-2410 CONFIRM BID
oracle -- hospitality_reporting_and_analytics	Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker having Report privilege with logon to the infrastructure where Oracle Hospitality Reporting and Analytics executes to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).	2019-01-16	3.6	CVE-2019-2397 CONFIRM BID
oracle -- hospitality_reporting_and_analytics	Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker having Report privilege with logon to the infrastructure where Oracle Hospitality Reporting and Analytics executes to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).	2019-01-16	3.6	CVE-2019-2407 CONFIRM BID
oracle -- jdk	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). The supported version that is affected is Java SE: 8u192. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).	2019-01-16	2.6	CVE-2019-2449 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H).	2019-01-16	3.8	CVE-2019-2503 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell). Supported versions that are affected are 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N).	2019-01-16	1.2	CVE-2019-2513 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.13 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).	2019-01-16	1.9	CVE-2019-2535 CONFIRM BID CONFIRM
oracle -- mysql	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 8.0.13 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:H).	2019-01-16	1.2	CVE-2019-2536 CONFIRM BID CONFIRM
oracle -- peoplesoft_enterprise_campus_software_campus_community	Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks). Supported versions that are affected are 9.0 and 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).	2019-01-16	2.6	CVE-2019-2493 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).	2019-01-16	2.1	CVE-2019-2446 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).	2019-01-16	2.1	CVE-2019-2448 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).	2019-01-16	2.1	CVE-2019-2450 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).	2019-01-16	2.1	CVE-2019-2451 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).	2019-01-16	2.1	CVE-2019-2501 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).	2019-01-16	2.1	CVE-2019-2504 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).	2019-01-16	2.1	CVE-2019-2505 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).	2019-01-16	2.1	CVE-2019-2506 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).	2019-01-16	1.9	CVE-2019-2525 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).	2019-01-16	2.1	CVE-2019-2527 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).	2019-01-16	2.1	CVE-2019-2553 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).	2019-01-16	2.1	CVE-2019-2554 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).	2019-01-16	2.1	CVE-2019-2555 CONFIRM BID
oracle -- vm_virtualbox	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).	2019-01-16	2.1	CVE-2019-2556 CONFIRM BID

Severity Not Yet Assigned

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
abb -- relion_630_devices	ABB Relion 630 devices 1.1 before 1.1.0.C0, 1.2 before 1.2.0.B3, and 1.3 before 1.3.0.A6 allow remote attackers to cause a denial of service (reboot) via a reboot command in an SPA message.	2019-01-15	not yet calculated	CVE-2018-20720 CONFIRM BID
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19711 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19719 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19717 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19716 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19715 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19714 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19713 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19712 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16038 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19709 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19722 CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19708 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19707 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19706 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19705 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19704 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19703 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19702 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19710 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19720 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19701 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15991 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16041 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16037 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16047 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16046 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation.	2019-01-18	not yet calculated	CVE-2018-16045 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation.	2019-01-18	not yet calculated	CVE-2018-16044 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-12830 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16043 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16042 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16040 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19700 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16023 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-15985 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-15986 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15987 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15988 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-15989 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15990 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-19698 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-19699 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15992 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-15984 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15994 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16004 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-15996 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-15997 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier version, and 2015.006.30461 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation.	2019-01-18	not yet calculated	CVE-2018-16018 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15999 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16000 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16001 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16002 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16015 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16003 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16014 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16006 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16007 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16008 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16009 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16010 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier version, and 2015.006.30461 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16011 BID BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16012 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16013 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16005 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-15995 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15998 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16016 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16017 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16019 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16020 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16021 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16022 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15993 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16024 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16025 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16026 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16039 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16027 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16029 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16030 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16031 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16032 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16033 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16034 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16035 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-16036 BID CONFIRM
adobe -- acrobat_and_reader	Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-16028 BID CONFIRM
adobe -- connect	Adobe Connect versions 9.8.1 and earlier have a session token exposure vulnerability. Successful exploitation could lead to exposure of the privileges granted to a session.	2019-01-18	not yet calculated	CVE-2018-19718 BID CONFIRM
adobe -- digital_editions	Adobe Digital Editions versions 4.5.9 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-01-18	not yet calculated	CVE-2018-12817 BID CONFIRM
adobe -- flash_player	Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-01-18	not yet calculated	CVE-2018-15982 BID REDHAT CONFIRM EXPLOIT-DB
adobe -- flash_player	Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.	2019-01-18	not yet calculated	CVE-2018-15983 BID CONFIRM
apple -- multiple_products	In iOS before 11.4, iCloud for Windows before 7.5, watchOS before 4.3.1, iTunes before 12.7.5 for Windows, and macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.	2019-01-11	not yet calculated	CVE-2018-4194 MISC CONFIRM
apple -- multiple_products	In iOS before 11.3, tvOS before 11.3, watchOS before 4.3, and macOS before High Sierra 10.13.4, an information disclosure issue existed in the transition of program state. This issue was addressed with improved state handling.	2019-01-11	not yet calculated	CVE-2018-4185 MISC MISC CONFIRM MISC
atlassian -- universal_plugin_manager	The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.	2019-01-18	not yet calculated	CVE-2018-20233 CONFIRM
ceph -- ceph	It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.	2019-01-15	not yet calculated	CVE-2018-14662 CONFIRM MISC
ceph -- ceph	It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.	2019-01-15	not yet calculated	CVE-2018-16846 CONFIRM MISC
cisco -- 900_series_aggregation_services_router	A vulnerability in Cisco 900 Series Aggregation Services Router (ASR) software could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of certain broadcast packets ingress to the device. An attacker could exploit this vulnerability by sending large streams of broadcast packets to an affected device. If successful, an exploit could allow an attacker to impact services running on the device, resulting in a partial DoS condition.	2019-01-11	not yet calculated	CVE-2018-15464 BID CISCO
cubecart -- cubecart	CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature.	2019-01-15	not yet calculated	CVE-2018-20716 MISC
dell -- networking_os10	Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.	2019-01-18	not yet calculated	CVE-2018-15784 MISC
drupal -- drupal	In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.	2019-01-15	not yet calculated	CVE-2017-6924 BID SECTRACK CONFIRM
drupal -- drupal	In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.	2019-01-15	not yet calculated	CVE-2017-6925 BID SECTRACK CONFIRM
drupal -- drupal	In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.	2019-01-15	not yet calculated	CVE-2017-6921 BID SECTRACK CONFIRM
etcd -- etcd	etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.	2019-01-14	not yet calculated	CVE-2018-16886 BID CONFIRM MISC MISC
gnu -- binutils	A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.	2019-01-14	not yet calculated	CVE-2018-20712 BID MISC MISC
ibm -- security_identity_manager	IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265.	2019-01-18	not yet calculated	CVE-2018-2019 BID XF CONFIRM
isc -- bind	Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.	2019-01-16	not yet calculated	CVE-2017-3137 BID SECTRACK SECTRACK REDHAT REDHAT REDHAT REDHAT CONFIRM GENTOO CONFIRM DEBIAN
isc -- bind	An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.	2019-01-16	not yet calculated	CVE-2017-3143 BID SECTRACK REDHAT REDHAT CONFIRM CONFIRM DEBIAN
isc -- bind	The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.	2019-01-16	not yet calculated	CVE-2017-3141 BID SECTRACK CONFIRM GENTOO CONFIRM EXPLOIT-DB
isc -- bind	An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.	2019-01-16	not yet calculated	CVE-2017-3142 BID SECTRACK REDHAT REDHAT CONFIRM CONFIRM DEBIAN
isc -- bind	Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.	2019-01-16	not yet calculated	CVE-2017-3135 REDHAT BID SECTRACK CONFIRM CONFIRM GENTOO CONFIRM DEBIAN
isc -- bind	If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1.	2019-01-16	not yet calculated	CVE-2017-3140 BID SECTRACK CONFIRM CONFIRM GENTOO CONFIRM
isc -- bind	named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.	2019-01-16	not yet calculated	CVE-2017-3138 BID SECTRACK CONFIRM GENTOO CONFIRM DEBIAN
isc -- bind	A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.	2019-01-16	not yet calculated	CVE-2017-3136 BID SECTRACK REDHAT REDHAT CONFIRM CONFIRM GENTOO CONFIRM DEBIAN
isc -- bind	An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes. Please note: This vulnerability affects the "nxdomain-redirect" feature, which is one of two methods of handling NXDOMAIN redirection, and is only available in certain versions of BIND. Redirection using zones of type "redirect" is not affected by this vulnerability. Affects BIND 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1.	2019-01-16	not yet calculated	CVE-2016-9778 BID SECTRACK CONFIRM GENTOO CONFIRM
isc -- bind	BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.	2019-01-16	not yet calculated	CVE-2017-3145 BID SECTRACK REDHAT REDHAT REDHAT REDHAT CONFIRM MLIST CONFIRM DEBIAN
isc -- dhcp	A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.	2019-01-16	not yet calculated	CVE-2017-3144 BID SECTRACK REDHAT CONFIRM UBUNTU DEBIAN
limesurvey -- limesurvey	LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address, which is mishandled in the admin panel.	2019-01-15	not yet calculated	CVE-2017-18358 MISC MISC
mailenable -- mailenable	MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.	2019-01-16	not yet calculated	CVE-2015-9278 MISC MISC MISC
nedi_consulting -- nedi	A stored cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php.	2019-01-16	not yet calculated	CVE-2018-20731 MISC MISC
nedi_consulting -- nedi	A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component.	2019-01-16	not yet calculated	CVE-2018-20730 MISC MISC
nedi_consulting -- nedi	A reflected cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php.	2019-01-16	not yet calculated	CVE-2018-20729 MISC MISC
nedi_consulting -- nedi	A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php.	2019-01-16	not yet calculated	CVE-2018-20728 MISC MISC
nedi_consulting -- nedi	Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.	2019-01-16	not yet calculated	CVE-2018-20727 MISC MISC
oxid -- esales	The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.	2019-01-15	not yet calculated	CVE-2018-20715 MISC
prestashop -- prestashop	In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to gain Remote Code Execution. This occurs because protection against serialized objects looks for a 0: followed by an integer, but does not consider 0:+ followed by an integer.	2019-01-15	not yet calculated	CVE-2018-20717 MISC MISC
pydio -- pydio	In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. An attacker either needs a "public link" of a file, or access to any unprivileged user account for creation of such a link.	2019-01-15	not yet calculated	CVE-2018-20718 MISC
qualcomm -- snapdragon	While processing a packet decode request in MQTT, Race condition can occur leading to an out-of-bounds access in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 427, SD 435, SD 450, SD 625, SD 636, SD 835, SDA660, SDM630, SDM660, Snapdragon_High_Med_2016	2019-01-18	not yet calculated	CVE-2018-11998 CONFIRM
qualcomm -- snapdragon	Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with the server in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 636, SDA660, SDM630, SDM660, SDX20	2019-01-18	not yet calculated	CVE-2018-11284 CONFIRM
qualcomm -- snapdragon	Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDX20, SXR1130	2019-01-18	not yet calculated	CVE-2017-18332 BID CONFIRM
qualcomm -- snapdragon	Improper access control on secure display buffers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 820, SD 820A, SD 835, SDA660	2019-01-18	not yet calculated	CVE-2017-18331 BID CONFIRM
qualcomm -- snapdragon	AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update everytime in snapdragon mobile and snapdragon wear in versions MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 835, SD 845, SD 850	2019-01-18	not yet calculated	CVE-2017-18160 BID CONFIRM
qualcomm -- snapdragon	Improper authorization involving a fuse in TrustZone in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016.	2019-01-18	not yet calculated	CVE-2017-8276 BID CONFIRM
qualcomm -- snapdragon	Improper check while accessing the local memory stack on MQTT connection request can lead to buffer overflow in snapdragon wear in versions MDM9206, MDM9607	2019-01-18	not yet calculated	CVE-2018-11993 CONFIRM
qualcomm -- snapdragon	Lack of check of input size can make device memory get corrupted because of buffer overflow in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 810, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130	2019-01-18	not yet calculated	CVE-2018-11279 BID CONFIRM
qualcomm -- snapdragon	Improper input validation in trustzone can lead to denial of service in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 636, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM630, SDM660, SDX24	2019-01-18	not yet calculated	CVE-2018-11999 BID CONFIRM
qualcomm -- snapdragon	Anti-rollback can be bypassed in replay scenario during app loading due to improper error handling of RPMB writes in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDX24, SXR1130	2019-01-18	not yet calculated	CVE-2018-3595 BID CONFIRM
qualcomm -- snapdragon	Possible undefined behavior due to lack of size check in function for parameter segment_idx can lead to a read outside of the intended region in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDX24, SXR1130	2019-01-18	not yet calculated	CVE-2018-11288 CONFIRM
rsa -- authentication_manager	The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup deployment of the initial RSA Authentication Manager system, could allow the attacker unauthorized access to that system.	2019-01-16	not yet calculated	CVE-2018-15782 FULLDISC
sas -- web_infrastructure_platform	SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.	2019-01-16	not yet calculated	CVE-2018-20732 BID MISC
sas -- web_infrastructure_platform	BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.	2019-01-16	not yet calculated	CVE-2018-20733 MISC
sas -- web_infrastructure_platform	Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.	2019-01-16	not yet calculated	CVE-2015-9281 MISC
serendipity -- serendipity	Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.	2019-01-15	not yet calculated	CVE-2016-10737 EXPLOIT-DB
shopware -- shopware	Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.	2019-01-15	not yet calculated	CVE-2017-18357 MISC MISC
smartertools -- smartermail	SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.	2019-01-16	not yet calculated	CVE-2015-9276 MISC MISC MISC
systemd -- systemd-journald	An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.	2019-01-11	not yet calculated	CVE-2018-16866 BID CONFIRM CONFIRM UBUNTU DEBIAN MISC
systemd -- systemd-journald	An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.	2019-01-11	not yet calculated	CVE-2018-16864 BID REDHAT CONFIRM CONFIRM UBUNTU DEBIAN MISC
systemd -- systemd-journald	An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.	2019-01-11	not yet calculated	CVE-2018-16865 BID REDHAT CONFIRM CONFIRM UBUNTU DEBIAN MISC
systemd -- systemd	It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.	2019-01-14	not yet calculated	CVE-2018-16888 CONFIRM
tibco -- spotfire	The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when the Spotfire Library is configured to use external storage. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace versions up to and including 10.0.0, and TIBCO Spotfire Server versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0; 10.0.0.	2019-01-16	not yet calculated	CVE-2018-18812 BID MISC CONFIRM
tibco -- spotfire	The Spotfire web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains multiple vulnerabilities that may allow persistent and reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.0.0, and TIBCO Spotfire Server: versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0; 10.0.0.	2019-01-16	not yet calculated	CVE-2018-18813 BID MISC CONFIRM
tibco -- spotfire	The TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability in the handling of the authentication that theoretically may allow an attacker to gain full access to a target account, independent of configured authentication mechanisms. Affected releases are TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.0.0, and TIBCO Spotfire Server: versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0.	2019-01-16	not yet calculated	CVE-2018-18814 BID MISC CONFIRM
uriparser -- uriparser	URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.	2019-01-16	not yet calculated	CVE-2018-20721 CONFIRM CONFIRM
wordpress -- wordpress	The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin.	2019-01-15	not yet calculated	CVE-2018-20714 MISC
wordpress -- wordpress	In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection involving the includes/shortcodes/class-wc-shortcode-products.php WC_Shortcode_Products::get_products() use of cached queries within shortcodes.	2019-01-15	not yet calculated	CVE-2017-18356 MISC MISC

This product is provided subject to this Notification and this Privacy & Use policy.

from US-CERT National Cyber Alert System http://bit.ly/2DrDdIt

Read More Add comment

Planning technology needs

Why plan technology?

Which technology: Specialized or ‘Off the shelf?’

Key features of technology

Where to use technology?

Business plan with technology

Exercise caution

What We Think Technology Can Do

What Technology Can Actually Do

Ideas First, Technology Second

What do you want to achieve?

How do you think you can solve the problem without technology?

Focus on the why and how of the problem.

Technology Is Not the Answer to All

Reference

1. 3D Printed Organs

2. Better Medical Imaging

3. Improvements in Medical Education

4. 3D Printed Casts for Broken Bones

5. Engineering Safer Vehicles with 3D Printing Technology

The technology, the patent and the business model

Price control over technology licensing fees

The demand to issue compulsory licences

Revocation request under Section 66

The lawsuits before the Bombay and Delhi High Courts & the inevitable question on gene patents

The Competition Commission investigation

Rebuilding Societal Trust

High Vulnerabilities

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned

Recent Posts

Facebook