Stored Cross-Site Scripting Vulnerability in YzmCMS v3.8

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A stored cross-site scripting vulnerability exists in YzmCMS v3.8. Attackers can insert malicious js code in the page to obtain user...

CVE-2018-10223

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...

CVE-2018-10224

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...

Cross site request forgery (csrf)

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...

CVE-2018-10223

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...

CVE-2018-10223

CVE-2018-10223 affects YzmCMS 3.8. It is a Cross-Site Request Forgery (CSRF) vulnerability in /index.php/admin/admin_manage/add.html that can add an administrator account. Implication: attacker could obtain admin privileges on the affected system. Root cause: CSRF flaw enabling unauthorized admin...

YzmCMS Cross-Site Request Forgery Vulnerability

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site request forgery vulnerability exists in YzmCMS version 3.8. Remote attackers can use the /index.php/admin/tag/add.html page to add a Tag using this vulnerability...

JomEstate, 3.7, SQL Injection

JomEstate from comdev.eu, versions 3.7 and previous, SQL Injection resolution: resolved in version 3.8, current release is 4.1 update notice: none...

Microsoft Info - Filter Bypass & Persistent Vulnerability

Document Title: =============== Microsoft Info - Filter Bypass & Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2023 MSRC ID: TRK:0901002416 Release Date: ============= 2017-09-05 Vulnerability Laboratory ID VL-ID:...

x86 to LLVM Bitcode Translation Framework: McSema

x86 to LLVM Bitcode Translation Framework McSema lifts x86 and amd64 binaries to LLVM bitcode modules. McSema support both Linux and Windows binaries, and most x86 and amd64 instructions, including integer, FPU, and SSE operations. McSema is separated into two conceptual parts: control flow...

Trend Micro Deep Discovery Inspector RCE Vulnerability

Trend Micro Deep Discovery Inspector is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Design/Logic Flaw

hotfixupload.cgi in Trend Micro Deep Discovery Inspector DDI 3.7, 3.8 SP1 3.81, and 3.8 SP2 3.82 allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header...

SUSE-SU-2016:1442-1 Security update for mercurial

This update for mercurial fixes the following issues: Security issues fixed: - CVE-2016-3105: Versionsprior to 3.8 allowed arbitrary code execution when using the convert extension on Git repo. bsc978391...

VoipNow v4.0.1 - (xajax_handler) Persistent Vulnerability

Document Title: =============== VoipNow v4.0.1 - xajaxhandler Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1828 Release Date: ============= 2016-04-26 Vulnerability Laboratory ID VL-ID: ==================================== 182...

Design/Logic Flaw

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records...

Meld - Visual Diff And Merge Tool Targeted At Developers

Meld is a visual diff and merge tool targeted at developers. Meld helps you compare files, directories, and version controlled projects. It provides two- and three-way comparison of both files and directories, and has support for many popular version control systems. Meld helps you review code...

Fedora 23 : webkitgtk4-2.10.9-1.fc23 (2016-7eb48a78dc)

This update together with the previous release brings the following fixes Security fixes: CVE-2016-1726 Limit the number of tiles according to the visible area. This was causing a huge memory consumption with some websites. Fix rendering of form controls and scrollbars with GTK+ = 3.19. Fix HTTP...

atl2 driver memory leak vulnerability

The atl2 driver is a set of Linux kernel drivers for Ethernet adapters. scatter/gather IO is a standard technique used for high-performance IO. netiffsg is an identifier used to determine whether scatter/gather I/O is enabled. A security vulnerability exists in the atl2 driver versions 3.8 throug...

WordPress < 3.7.6 / 3.8.x < 3.8.6 / 3.9.x < 3.9.4 / 4.1.x < 4.1.2 Multiple Vulnerabilities

Binary data 9026.prm...

Russian ATM Hackers Steal $4 Million in Cash with 'Reverse ATM Hack' Technique

Russian hackers have discovered a novel technique to rip off Millions of dollars from banks and ATMs. Criminals in Russia used a technique, called “Reverse ATM Attack,” and stole 252 Million Rubles US$3.8 Million from at least five different banks, according to the information obtained by Russian...