CVE-2020-13909: Undefined Security Weakness

The Ignition component before 2.0.5 for Laravel mishandles globals, get, post, cookie, and env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix...

Arbitrary Code Execution

php is vulnerable to arbitrary code execution. A flaw was found in the way the mbstring extension set global variables. A script which used the mbparsestr function to set global variables could be forced to enable the registerglobals configuration option, possibly resulting in global variable...

RUSTSEC-2020-0004 sigstack allocation bug can cause memory corruption or leak

An embedding using affected versions of lucet-runtime configured to use non-default Wasm globals sizes of more than 4KiB, or compiled in debug mode without optimizations, could leak data from the signal handler stack to guest programs. This can potentially cause data from the embedding host to le...

PT-2020-17491

Name of the Vulnerable Software and Affected Versions lucet-runtime-internals versions prior to 0.5.1 Description The issue is related to the mishandling of sigstack allocation in the lucet-runtime-internals crate. This can potentially allow guest programs to obtain sensitive information or...

CVE-2018-16343

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

CVE-2018-16343

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

CVE-2018-16343

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

CVE-2018-16343

SeaCMS 6.61 contains a remote code execution flaw: the parseIf() function in include/main.class.php fails to block use of $GLOBALS, enabling attackers to run arbitrary code. This has been documented across multiple sources (CNVD-2018-19075 and NVD/NVD-derived entries) and is tied to SeaCMS’s PHP ...

CVE-2018-16343: Improper Control of Generation of Code

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

PT-2018-13503

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.61 Description The issue allows remote attackers to execute arbitrary code. This is due to the parseIf function in include/main.class.php not blocking the use of $GLOBALS. Recommendations For SeaCMS version 6.61, consider...

OpenEMR SQL Injection Vulnerability (CNVD-2018-17195)

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A SQL injection vulnerability exists in the...

PT-2018-4114

Name of the Vulnerable Software and Affected Versions csrf-magic versions prior to 1.0.4 Description The issue allows an attacker to bypass CSRF protections due to a predictable Anti-CSRF Token. This predictability occurs when the $GLOBALS'csrf''secret' is not configured, resulting in the lack of...

CVE-2018-6905

The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS'TYPO3CONFVARS''SYS''sitename', as demonstrated by an admin entering a crafted site name during the installation process...

Epignosis eFront Code Execution Vulnerability

Epignosis eFront is an online learning system with an Ajax interface from Epignosis USA. The system allows you to create and manage courses with tools such as a content editor, file manager, and digital library. A code execution vulnerability exists in the globals.php page in eFront version 3.6.1...

Google Chrome < 54.0.2840.87 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 54.0.2840.87. It is, therefore, affected by a vulnerability as referenced in the 201611stable-channel-update-for-desktop advisory. - V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and...

Claroline 1.7.7 - Arbitrary File Inclusion

Claroline 1.7.7 - Arbitrary File Inclusion Claroline Arbitrary File Inclusion Vendor: Claroline Product: Claroline Version: 0 $uidReset = true; $clarologinSucceeded = true; break; e...

PHP File Manager Authentication Bypass Vulnerability

PHP File Manager is a suite of applications for managing web sites using PHP scripts. An authentication bypass vulnerability exists in PHP File Manager version 0.9.8 due to incorrectly registered global variables. An attacker is able to override the block key group, establish a valid session, and...

Ovidentia troubleticketsModule 7.6 - Remote File Inclusion

Exploit for php platform in category web applications Title: Ovidentia Module troubletickets 7.6 GLOBALSbabInstallPath Remote File Inclusion Vulnerability Author: bd0rk || SCHOOL-OF-HACK.NET eMail: bd0rkathackermail.com Website: http://www.school-of-hack.net Download:...

Advantech WebAccess webvrpcs Service BwpAlarm.dll memcpy Globals Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable instances of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x11172 IOCTL in the BwpAlarm subsystem. A globals overflow...

PHP File Manager 0.9.8 Authentication Bypass / Code Execution

PHP File Manager 0.9.8 http://phpfm.sourceforge.net/ is vulnerable to authentication bypass due to insecure implementation of register globals emulation. An attacker is able to override the blockKeys array and thus build a valid session and access all the protected functionality including executi...