Arbitrary File Deletion Vulnerability in ZengCMS

ZengCMS is a backend management system based on the latest TP6.0.x framework and Layui 2.5.x. ZengCMS suffers from an arbitrary file deletion vulnerability, which can be exploited by attackers to delete system files...

CVE-2021-27212

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service daemon exit via a short timestamp. This is related to schemainit.c and checkTime...

CVE-2021-27212

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service daemon exit via a short timestamp. This is related to schemainit.c and checkTime...

OpenLDAP Security Vulnerabilities

OpenLDAP is an open source implementation of the Lightweight Directory Access Protocol LDAP from the OpenLDAP Openldap Foundation in the United States. A security vulnerability exists in OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, which results in a denial of service daemon exit via a...

CVE-2020-10933

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocketreadnonblockrequestedsize, buffer, exception: false, the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous valu...

CVE-2020-10933

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocketreadnonblockrequestedsize, buffer, exception: false, the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous valu...

CVE-2019-17564

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

PT-2020-2439

Name of the Vulnerable Software and Affected Versions Ruby versions 2.5.x through 2.5.7 Ruby versions 2.6.x through 2.6.5 Ruby version 2.7.0 Description An issue in Ruby may expose possibly sensitive data from the interpreter. This occurs when the BasicSocketread nonblock method is called with th...

Joomla 2.5.x < 3.9.14 Multiple Vulnerabilities (5781-joomla-3-9-14)

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.14. It is, therefore, affected by multiple vulnerabilities. - Missing access check in framework files could lead to a path disclosure. CVE-2019-19845 - The lack of validation of...

Stack overflow

A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable in liblouis. An attacker could create a malicious file that would cause applications that use liblouis such as Orca to crash, or potentially execute arbitrary code when opened...

CVE-2019-3790

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was...

Joomla! 2.5.x < 3.9.2 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - Stored XSS in modbanners affects Joomla 2.5.0 through 3.9.1 - Stored XSS in comcontact affects Joomla 2.5.0 through 3.9.1 - Stored XSS issue in the Global Configuration...

Joomla! 2.5.x < 3.8.9 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - Local file inclusion with PHP 5.3 affects Joomla 2.5.0 through 3.8.8 - XSS vulnerability in language switcher module affects Joomla 1.6.0 through 3.8.8 Note that the scanner...

Joomla! 2.5.x < 3.7.0 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A flaw exists in the JMail API due to PHPMail version information being included in mail headers. An unauthenticated, remote attacker can exploit this to disclose sensitive...

Apache Struts 2.5.x < 2.5.12 Multiple DoS (S2-047) (S2-049)

The version of Apache Struts running on the remote host is 2.5.x prior to 2.5.12. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when handling a specially crafted URL in a form field when the built-in URL validator is used. An unauthenticated,...

PT-2017-11743 · Cz.Nic +1 · Knot Dns +1

Name of the Vulnerable Software and Affected Versions: Knot DNS versions prior to 2.4.5 Knot DNS versions 2.5.x prior to 2.5.2 Description: The issue is related to a flaw in the TSIG protocol implementation. This flaw allows an attacker with a valid key name and algorithm to bypass TSIG...

Remote Code Execution (RCE)

struts2-struts1-plugin is vulnerable to remote code execution RCE attacks. These attacks are possible because the user input are not sanitized and are directly passed through messages.add to be used as a part of an error message in the ActionMessage class. This doesn't affect users of the Struts...

Atlassian Crowd 2.5.x < 2.5.4 Information Disclosure

Binary data 700020.prm...

PT-2019-4673 · Puma +9 · Puma +10

Name of the Vulnerable Software and Affected Versions: Ruby versions prior to 2.4.8 Ruby versions 2.5.x through 2.5.6 Ruby versions 2.6.x through 2.6.4 Puma versions prior to 3.12.3 Puma versions prior to 4.3.2 Description: The issue is related to incorrect handling of special elements in the...

CVE-2016-0738

CVE-2016-0738 affects OpenStack Swift (Object Storage) prior to 2.3.1 in Kilo, 2.4.x, and prior to 2.5.1 in Liberty. The issue is a memory-leak/unfinished-read vulnerability that can allow a remote attacker (authenticated) to cause a denial of service by exhausting proxy-server resources through ...