CMSUno 1.6.2 Remote Code Execution

Exploit Title: CMSUno 1.6.2 - 'lang' Remote Code Execution Authenticated Google Dork: N/A Date: 2020.09.30 Exploit Author: Fatih Çelik Vendor Homepage: https://github.com/boiteasite/cmsuno/ Software Link: https://github.com/boiteasite/cmsuno/ Blog:...

WordPress Advanced Booking Calendar plugin <= 1.6.1 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability found by Lenon Leite in WordPress Advanced Booking Calendar plugin versions = 1.6.1. Solution Update the WordPress Advanced Booking Calendar plugin to the latest available version at least 1.6.2...

Security Bulletin: WML CE: TensorFlow: In SQLite before 3.32.3, select.c mishandles query-flattener optimization

Summary In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. TensorFlow in WML CE uses SQLite as its embedded SQL database engine. Vulnerability Details CVEID:...

Security update for mp3gain (moderate)

openSUSE Security Update: Security update for mp3gain Announcement ID: openSUSE-SU-2020:0539-1 Rating: moderate References: 1154971 Cross-References: CVE-2017-12911 CVE-2019-18359 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes two vulnerabilities is now available...

OPENSUSE-SU-2020:0522-1 Security update for mp3gain

This update for mp3gain fixes the following issues: Update to version 1.6.2. - CVE-2019-18359: Fixed a buffer over-read was discovered in ReadMP3APETag boo1154971...

Memcached buffer overflow vulnerability (CNVD-2020-23209)

Memcached is the United States Brad Fitzpatrick Brad Fitzpatrick software developers of a high-performance distributed memory object caching system. The system by caching data and objects in memory to reduce the number of times to read the database , thus improving the speed of access to the site...

PT-2020-12432 · Memcached +1 · Memcached +1

Name of the Vulnerable Software and Affected Versions: memcached versions 1.6.x before 1.6.2 Description: The issue allows remote attackers to cause a denial of service, resulting in a daemon crash. This is achieved by sending a crafted binary protocol header to the try read command binary functi...

Memcached 1.6.x < 1.6.2 DoS Vulnerability

Memcached is prone to a denial of service DoS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

HashiCorp Consul HTTP/RPC services Denial of Service Vulnerability

HashiCorp Consul is a service grid for service discovery, runtime configuration and solutions for microservice applications and infrastructure. A security vulnerability exists in HashiCorp Consul and Consul Enterprise versions 1.6.2 and earlier. An attacker could exploit the vulnerability to caus...

PT-2020-19874 · Hashicorp +1 · Hashicorp Consul +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions 1.4.1 through 1.6.2 Description: The issue results from the non-uniform enforcement of Access Control Lists ACLs across all API endpoints, potentially leading to unintended information disclosur...

Security Bulletin: A security vulnerability has been identified in OpenCV shipped with PowerAI

Summary Multiple Vulnerabilities CVE-2019-14493, CVE-2019-14492 and CVE-2019-14491 were found in OpenCV package. Vulnerability Details CVEID: CVE-2019-14493 DESCRIPTION: An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at...

Security Bulletin: Multiple vulenerabilities CVE-2019-0205, CVE-2019-0210 in thrift package

Summary Multiple vulenerabilities CVE-2019-0205, CVE-2019-0210 in thrift package Vulnerability Details CVEID: CVE-2019-0205 DESCRIPTION: In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue...

Debian DLA-1967-1 : libpcap security update

libpcap Packet CAPture, a low-level network monitoring library, does not properly validate the PHB header length before allocating memory. This update added sanity checks for PHB header length. For Debian 8 'Jessie', this problem has been fixed in version 1.6.2-2+deb8u1. We recommend that you...

WordPress microblog-poster plugin SQL injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. microblog-poster is a plugin used to automatically post web content to social media. A SQL injection vulnerability exists in the...

Joomla! 1.6.2 < 3.9.11 Incorrect Access Control

According to its self-reported version number, the detected Joomla! application is affected by an incorrect access control vulnerability in versions 1.6.2 to 3.9.10 due to inadequate checks in comcontact. Note that the scanner has not tested for these issues but has instead relied only on the...

WordPress Advanced Contact form 7 DB Plugin < 1.6.2 SQL Injection Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

PT-2019-13431 · Vsourz Digital · Vsourz Digital Advanced Cf7 Db Plugin

Name of the Vulnerable Software and Affected Versions: Vsourz Digital Advanced CF7 DB plugin versions prior to 1.6.2 Description: A SQL injection issue exists, allowing a remote attacker to execute arbitrary SQL commands on the affected system. Recommendations: For Vsourz Digital Advanced CF7 DB...

CVE-2018-20849

Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATHINFO to the login/ URI...

CVE-2018-20849

Arastta eCommerce 1.6.2 is affected by CVE-2018-20849: a cross-site scripting (XSS) vulnerability exploitable via PATH_INFO to the login/ URI. The root cause is insufficient input validation leading to stored/reflective-like misuse of user-controlled data that can affect the login path. Documente...

Arastta eCommerce Cross-Site Scripting Vulnerability

Arastta eCommerce is an open source eCommerce platform. A cross-site scripting vulnerability exists in Arastta eCommerce version 1.6.2. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...