CVE-2019-17417: Improper Neutralization of Input During Web Page Generation

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

SQL injection vulnerability in p****t.asp page of basic website building system of Shenzhen Tiandixin Network Technology Co.

Tiandixin network was founded in 2010, is a strategic research and development-oriented enterprises, many large-scale project experience, more than tens of thousands of Chinese enterprises common choice of website platform builder, the company mainly focuses on corporate website construction, Bai...

SQL injection vulnerability in p***w.asp page of basic website building system of Shenzhen Tiandixin Network Technology Co.

Tiandixin network was founded in 2010, is a strategic research and development-oriented enterprises, many large-scale project experience, more than tens of thousands of Chinese enterprises common choice of website platform builder, the company mainly focuses on corporate website construction, Bai...

PT-2019-7352

Name of the Vulnerable Software and Affected Versions users-ultra plugin versions prior to 1.5.63 Description The issue concerns a cross-site scripting XSS flaw. It is exploited via the p desc parameter. Recommendations For versions prior to 1.5.63, update to version 1.5.63 or later to resolve th...

PT-2019-7351

Name of the Vulnerable Software and Affected Versions users-ultra plugin versions prior to 1.5.63 Description The issue concerns a cross-site scripting XSS flaw. It is exploited via the p name parameter. Recommendations For versions prior to 1.5.63, update to version 1.5.63 or later to resolve th...

PT-2019-14623

Name of the Vulnerable Software and Affected Versions Indexhibit version 2.1.5 Description The issue allows for a product reinstallation, which can result in remote code execution. This can be achieved via the "/ndxzstudio/install.php?p=2" API endpoint. Recommendations For Indexhibit version 2.1....

S-CM e-commerce system aj***.php page P_sort parameter SQL injection vulnerability

S-CMS e-commerce system is an e-commerce software. S-CM e-commerce system aj.php page Psort parameter SQL injection vulnerability, an attacker can use the vulnerability to obtain sensitive information...

DEBIAN-CVE-2019-9444

In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation...

CVE-2019-9444

In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation...

CVE-2019-7364

CVE-2019-7364 describes a DLL preloading vulnerability in Autodesk products (2017–2020 Autodesk Advanced Steel, Civil 3D, AutoCAD and related tools; plus AutoCAD P&ID 2017). The issue allows an attacker to cause code execution by persuading a user to open a malicious DWG file that leverages the D...

CVE-2019-14783

On Samsung mobile devices with N7.x, and O8.x, P9.0 software, FotaAgent allows a malicious application to create privileged files. The Samsung ID is SVE-2019-14764...

CVE-2019-3570

Call to the scryptenc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r and p. This happens if the parameters are configurable by an attacker for instance by providing the output of scryptenc in a context where Hack/PHP code would attempt to verify it by...

libvirt security update

5.0.0-9.el7 - qemu: remove cpuhostmask and cpuguestmask from virCaps structure Wim ten Have Orabug: 29956508 5.0.0-8.el7 - api: disallow virDomainSaveImageGetXMLDesc on read-only connections Jan Tomko Orabug: 29955742 CVE-2019-10161 - domain: Define explicit flags for saved image xml Eric Blake...

Linear eMerge 50P/5000P File Upload Vulnerability

The Linear eMerge 50P/5000P is an access control security system managed through a browser from Nortek Security & Control. A file upload vulnerability exists in the Linear eMerge 50P/5000P. An attacker could use this vulnerability to upload a file with an arbitrary extension to a directory in the...

CVE-2019-7270

Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery CSRF...

PT-2019-13053

Name of the Vulnerable Software and Affected Versions LiveZilla Server versions prior to 8.0.1.1 Description The issue concerns SQL Injection in the functions.internal.build.inc.php file via the p dt s d parameter. Recommendations For versions prior to 8.0.1.1, update to version 8.0.1.1 or later ...

PT-2019-13038

Name of the Vulnerable Software and Affected Versions LiveZilla Server versions prior to 8.0.1.1 Description The issue concerns SQL Injection in the server.php file via the p ext rse parameter. Recommendations For versions prior to 8.0.1.1, update to version 8.0.1.1 or later to resolve the issue...

USN-4021-1: libvirt vulnerabilities

Daniel P. Berrangé discovered that libvirt incorrectly handled socket permissions. A local attacker could possibly use this issue to access libvirt. CVE-2019-10132 It was discovered that libvirt incorrectly performed certain permission checks. A remote attacker could possibly use this issue to...

ZyXEL P-660HN-T1 V2 Missing Authentication / Password Disclosure Vulnerabilities

Exploit for hardware platform in category web applications Description: The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 2.00AAKK.3 devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the...

CVE-2019-6725

The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 2.00AAKK.3 devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the interface of the modem can be accessed as admin...