2019-03 Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB4474419)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

CVE-2018-17420

An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter...

Sql injection

An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter...

Design/Logic Flaw

An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html...

CVE-2018-14499

An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html...

CVE-2018-14499

An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html...

CVE-2018-17420

An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter...

CVE-2018-17420

Summary: CVE-2018-17420 affects ZrLog 2.0.3 with a SQL injection in the article management search box via the keywords parameter. The vulnerability is demonstrated in the NVD entry (CVSS v3 base 7.2, HIGH; vectors: NETWORK/LOW for exploitability, requires HIGH privileges, no user interaction). Th...

CVE-2018-14499

An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html...

CVE-2018-14499

HYBBS (through 2016-03-08) contains an XSS vulnerability that can be triggered via the article title when posting to post.html. The description in multiple sources confirms this flaw but does not provide affected versions beyond the date window or remediation guidance.

CVE-2018-17420

An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter...

Letterlocking

Really good article on the now-lost art of letterlocking...

CVE-2018-17420: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter...

PT-2019-9033

Name of the Vulnerable Software and Affected Versions HYBBS versions through 2016-03-08 Description An issue was found where there is an XSS issue via an article title to the "post.html" endpoint. Recommendations For versions through 2016-03-08, at the moment, there is no information about a newe...

PT-2019-9472

Name of the Vulnerable Software and Affected Versions ZrLog version 2.0.3 Description A SQL injection issue was found in the article management search box. The keywords parameter is vulnerable to this issue. Recommendations For ZrLog version 2.0.3, avoid using the keywords parameter in the articl...

CVE-2018-14499: Improper Neutralization of Input During Web Page Generation

An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html...

CVE-2019-9603

MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891...

PT-2019-19742

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for the deletion of articles via a CSRF vulnerability in the "mc-admin/post.php" endpoint, specifically when the "state" parameter is set to "publish" and the "delete" parameter is utilized...

Pluck Cross-Site Request Forgery Vulnerability (CNVD-2019-05782)

Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck version 4.7.9-dev1. A remote attacker can exploit this vulnerability to delete articles with /admin.php?action=deletepage&var1= URI...

Guidance to adjust HTTP/2 SETTINGS frames

Executive Summary Microsoft is aware of a potential condition which can be triggered when malicious HTTP/2 requests are sent to a Windows Server with the http.sys service enabled. This could temporarily cause the system CPU usage to spike to 100% until the malicious connections are killed by...