1467 matches found
Oracle WebCenter (Fatwire) 7.x Cross Site Scripting
Application: Oracle WebCenter Sites FatWire Content Server Versions Affected: 7.x 11gR1 Vendor URL: http://oracle.com Bugs: Multiple XSS Oracle WebCenter Sites FatWire Content Server 7.x 11gR1 Sent: 18.12.2017 Reported: 18.12.2017 Date of Public Advisory: 14.04.2018 Reference: Oracle Security Not...
Drupal Drupalgeddon 2 Forms API Property Injection Exploit
This Metasploit module exploits a Drupal property injection in the Forms API. Drupal versions 6.x, less than 7.58, 8.2.x, less than 8.3.9, less than 8.4.6, and less than 8.5.1 are vulnerable. This module requires Metasploit: https://metasploit.com/download Current source:...
Intel 2G Modem
1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION : Exploitable remotely Vendor : Intel Equipment : Intel 2G Modem Vulnerability : Buffer Overflow 2. RISK EVALUATION Successful exploitation of this buffer overflow vulnerability may allow remote code execution. The vulnerability affects Intel 2G modem...
Directory traversal
An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...
CVE-2018-9309
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...
Sql injection
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...
CVE-2018-9309
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...
PT-2018-18966 · Zzcms · Zzcms
Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in a "dl/dl sendsms.php" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "dl/dl sendsms.php" request until the issue is...
CVE-2018-8968
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
CVE-2018-8967
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request...
CVE-2018-8968
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
CVE-2018-8968
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
Directory traversal
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
CVE-2018-8969
An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
CVE-2018-8965
An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
CVE-2018-8966
An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...
Directory traversal
An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
Sql injection
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request...
Code injection
An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...