PT-2018-10059

Name of the Vulnerable Software and Affected Versions ASRock RGBLED versions prior to 1.0.35.1 A-Tuning versions prior to 3.0.210 F-Stream versions prior to 3.0.210 RestartToUEFI versions prior to 1.0.6.2 Description The issue allows a local attacker to elevate privileges by leveraging the expose...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2019-01728)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/uploadsselect.php file in DedeCMS version 5.7 SP2, which can be exploited by a remote attacker with the help of the 'f' or 'keyword' parameter to A remote attacker can use the 'f' ...

PT-2018-14589

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's password via the "index.php?m=core&f=panel&v=edit info" API endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contai...

CVE-2018-18711: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...

PT-2018-14590

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's username via the "index.php?m=member&f=index&v=edit&uid=1" endpoint, specifically targeting the uid variable set to 1, which corresponds to the super...

ASRock Drivers Privilege Escalation / Code Execution

SecureAuth - SecureAuth Labs Advisory http://www.secureauth.com/ ASRock Drivers Elevation of Privilege Vulnerabilities 1. Advisory Information Title: ASRock Drivers Elevation of Privilege Vulnerabilities Advisory ID: CORE-2018-0005 Advisory URL:...

f-f.ir XSS vulnerability

Open Bug Bounty ID: OBB-687934 Description| Value ---|--- Affected Website:| f-f.ir Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

CVE-2018-13805: Uncontrolled Resource Consumption

A vulnerability has been identified in SIMATIC ET 200SP Open Controller All versions = V2.0 and = V2.0 and = V2.0 and V2.5. An attacker can cause a denial-of-service condition on the network stack by sending a large number of specially crafted packets to the PLC. The PLC will lose its ability to...

Design/Logic Flaw

A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014...

CVE-2017-2751

A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014...

CVE-2018-17942

The converttodecimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing...

PT-2018-7184

Name of the Vulnerable Software and Affected Versions: Consumer notebooks with firmware F.22 Description: A BIOS password extraction issue has been reported, where the BIOS password was stored in CMOS in a way that allowed it to be extracted. This issue affects certain consumer notebooks launched...

CVE-2018-17832

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-17832

WUZHICMS 2.0 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the v and f GET parameters. The issue is described as XSS in the WUZHICMS 2.0 web application, with PoC references showing injected content via index.php?v= and index.php?f=. No explicit root-caus...

CVE-2018-17852

A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...

PT-2018-14225

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found in the coreframe/app/coupon/admin/card.php file, specifically via the groupname parameter to the "/index.php?m=coupon&f=card&v=detail listing" API endpoint. Recommendations Fo...

CVE-2018-17832: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

PT-2018-14212

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 2.0 Description A security issue exists due to the presence of XSS in the software. The issue is related to the v or f parameter in the "index.php" endpoint. Recommendations For WUZHI CMS version 2.0, consider restricting...

PT-2018-14189

Name of the Vulnerable Software and Affected Versions PCProtect Anti-Virus version 4.8.35 Description The issue allows local users to gain privileges by replacing an executable file with a Trojan horse due to "Everyone: F" permission for %PROGRAMFILESX86%PCProtect. Recommendations For PCProtect...

PT-2018-13509

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific page. The remark parameter in the form on the page index.php?m=link&f=index&v=add is vulnerable to XSS attacks. Recommendations For WUZHI CMS version...