h-include (1.0.0), hinclude (>=1.0.1, <=1.1.0) +4 more potentially affected by CVE-2018-16478 via simplehttpserver (>=0.0.6, <=0.2.1)

simplehttpserver NPM version =0.0.6, =1.0.1, =0.0.1, =0.0.2 Source cves: CVE-2018-16478 Source advisory: OSV:GHSA-VWR2-WJ63-86GR...

PT-2018-15120

Name of the Vulnerable Software and Affected Versions Metinfo version 6.1.3 Description The issue in Metinfo allows setting arbitrary HTTP headers, including the Cookie header, through include/interface/applogin.php. Additionally, common.inc.php permits registering variables from the $ COOKIE...

PHP-Proxy Weak Encryption Vulnerability

PHP-Proxy is a web-based proxy script featuring fast, easy customization and the ability to provide support for complex websites such as YouTube and Facebook. A weak encryption vulnerability in the strrotpass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy versions 5.1.0 and...

Sql injection

In SeaCMS v6.64, there is SQL injection via the adminmakehtml.php topic parameter because of mishandling in include/mkhtml.func.php...

CVE-2018-19349

In SeaCMS v6.64, there is SQL injection via the adminmakehtml.php topic parameter because of mishandling in include/mkhtml.func.php...

CVE-2018-19349: Improper Neutralization of Special Elements used in an SQL Command

In SeaCMS v6.64, there is SQL injection via the adminmakehtml.php topic parameter because of mishandling in include/mkhtml.func.php...

PT-2018-14933

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.64 Description The issue is related to SQL injection due to mishandling in the include/mkhtml.func.php file. This occurs via the topic parameter in the admin makehtml.php file. Recommendations For SeaCMS version 6.64, consider...

CVE-2018-18806

School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb...

CVE-2018-18804

Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb...

PT-2018-14667

Name of the Vulnerable Software and Affected Versions School Equipment Monitoring System version 1.0 Description The issue allows SQL injection via the login screen, related to include/user.vb. Recommendations For School Equipment Monitoring System version 1.0, consider restricting access to the...

PT-2018-14665

Name of the Vulnerable Software and Affected Versions Bakeshop Inventory System version 1.0 Description The issue is related to SQL injection via the login screen. It is connected to the include/publicfunction.vb file. Recommendations For Bakeshop Inventory System version 1.0, consider restrictin...

CVE-2018-18806: Improper Neutralization of Special Elements used in an SQL Command

School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb...

CVE-2018-18804: Improper Neutralization of Special Elements used in an SQL Command

Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb...

CVE-2018-18608: Improper Neutralization of Input During Web Page Generation

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...

GHSA-4XJH-M3QX-49WC Jekyll allows attackers to access arbitrary files by specifying a symlink

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the include key in the config.yml file...

DEBIAN-CVE-2018-17567

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "config.yml" file...

UBUNTU-CVE-2018-17567

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "config.yml" file...

CVE-2018-17567: Improper Link Resolution Before File Access

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "config.yml" file...

Jekyll _config.yml privilege escalation

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "config.yml" file...

Jekyll Arbitrary File Access Vulnerability

Jekyll is a static website generator. A security vulnerability exists in Jekyll version 3.6.2 and earlier, version 3.7.x through 3.7.3, and version 3.8.x through 3.8.3. An attacker can exploit the vulnerability by specifying a symbolic link in the 'include' key of the 'config.yml' file to access...