Sql injection

In install/pagedbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses...

CVE-2017-11174

In install/pagedbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses...

BBCBuilder e-commerce system has design flaws

BBCbuilder is a new model of b2b2c e-commerce system built by Yuanfeng Company. BBCBuilder e-commerce system has a logical design vulnerability. An attacker can modify the number of products purchased after logging in and then modify the payment amount by grabbing packets...

Cambium Networks ePMP Access Control Error Vulnerability

Cambium Networks ePMP is a suite of wireless network access platforms from Cambium Networks, USA. The platform provides video surveillance, Wi-Fi hotspot and sensor connectivity. An access control error vulnerability exists in Cambium Networks ePMP. A remote attacker could exploit the vulnerabili...

Authentication flaw

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...

CVE-2016-0767

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...

CVE-2016-2192

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own...

CVE-2016-2192

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own...

CVE-2017-3741

In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly. This issue only affects ThinkPad X1 Carbon 5th generation...

Design/Logic Flaw

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors...

CVE-2017-2091

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors...

CVE-2017-2091

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors...

CVE-2017-2094

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors...

Man In The Middle (MitM)

Salt is vulnerable to man in the middle MitM attack in minion authentication. It does not check the integrity of the message sent back by the master. It is possible to intercept the communication between the minion and master and alter certain information...

FLARE Script Series: Querying Dynamic State using the FireEye Labs Query-Oriented Debugger (flare-qdb)

Introduction This post continues the FireEye Labs Advanced Reverse Engineering FLARE script series. Here, we introduce flare-qdb, a command-line utility and Python module based on vivisect for querying and altering dynamic binary state conveniently, iteratively, and at scale. flare-qdb works on...

Man In The Middle (MitM)

jser-stat is vulnerable to man-in-the-middle MitM attacks due to downloading data resources over an insecure protocol. It is possible for an attacker to intercept this connection and alter the packages received...

VulnCheck KEV: CVE-2006-3227

Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, whi...

MariaDB 10.0.0 < 10.0.27 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.0.27. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.27 advisory. - Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and...

MariaDB Server 10.0.x < 10.0.27 Multiple DoS

Binary data 9544.prm...

Vtiger CRM does not properly restrict access to application data

Overview Vtiger CRM is a customer relationship management CRM software. Vtiger CRM contains a vulnerability where it does not properly restrict access to user information data. Hirota Kazuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with th...