CVE-2019-13302

A heap-based buffer over-read was discovered in ImageMagick in the way it performs complex mathematics on an image sequence. Applications compiled against ImageMagick libraries that accept untrustworthy images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a...

DIGISOL SYSTEMS DG-HR3400 Cross-Site Scripting Vulnerability

DIGISOL SYSTEMS DG-HR3400 is a wireless router from DIGISOL SYSTEMS India. A cross-site scripting vulnerability exists in the DIGISOL SYSTEMS DG-HR3400. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to...

Cross-site scripting vulnerability in multiple Zyxel devices

ZyXEL ZyWall 310 and others are products of Taiwan, China-based ZyXEL Corporation.ZyXEL ZyWall 310 is a 310 series VPN firewall appliance.ZyXEL ZyWall 110 is a 110 series VPN firewall appliance.ZyXEL USG1900 is a next-generation unified security gateway appliance. Zyxel ZyWall A cross-site...

Shanghai New Win-Win Information Technology Co., Ltd Au Bump Rental Car APP has Denial of Service Vulnerability

Au Rent a Car AP is a taxi and car rental software for life travel. Shanghai New Win-Win Information Technology Company Limited Au Bump Rent A Car AP suffers from a denial-of-service vulnerability, which can be exploited by an attacker to cause the application to crash by sending null, anomalous,...

Quadbase Systems EspressReport ES Cross-Site Scripting Vulnerability

Quadbase Systems EspressReport ES ERES is a centralized business intelligence reporting solution from Quadbase Systems, USA. A cross-site scripting vulnerability exists in Quadbase Systems ERES version 7.0 update 7. The vulnerability stems from a lack of proper validation of client-side data by t...

CVE-2019-3410

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16939)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

SQL Injection Vulnerability in B2C_UQ Cloud Business System

UQ Cloud Business System B2C version is a compact e-commerce system, the platform is developed by PHP7.0+Mysql. B2CUQ Cloud Business System suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

CVE-2019-5958

Untrusted search path vulnerability in Electronic reception and examination of application for radio licenses Offline 1.0.9.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-5430

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which...

CVE-2017-12760

Ynet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection. The impact is: Code execution remote...

Arbitrary File Deletion Vulnerability in CSZ-CMS Management System

CSZ-CMS is an open source web application that allows to manage all content and settings on a website. An arbitrary file deletion vulnerability exists in the CSZ-CMS management system, which can be exploited by an attacker to delete arbitrary files on the server...

Denial Of Service (DoS) And Remote Code Execution (RCE)

GStreamer is vulnerable to denial of service DoS and remote code execution RCE attacks. GStreamer's FLC/FLI/FLX media file format decoding plug-in is the flawed component. A remote attacker could crash or, potentially, execute arbitrary code with the privileges of the user running the application...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2019-14591)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in BM Sterling B2...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2019-14609)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in IBM Sterling B...

HPE Integrated Lights-Out 5 Cross-Site Scripting Vulnerability

HPE Integrated Lights-Out 5 iLO 5 is a remote control solution. The solution enables remote monitoring and operation and maintenance of IT assets such as servers. A cross-site scripting vulnerability exists in HPE Integrated iLO 5 for Gen10 ProLiant servers, which stems from the lack of proper...

Code injection

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

CloudBees Jenkins Nomad Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is a set of U.S. CloudBees company based on Java development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Nomad Plugin is used in one of the workload according t...

Azure DevOps Server Cross-Site Scripting Vulnerability

Microsoft Azure DevOps Server is a suite of software development collaboration tools from Microsoft Corporation USA. The product includes features such as sharing code, work tracking, and software distribution. A cross-site scripting vulnerability exists in Microsoft Azure DevOps Server 2019, whi...

ManageEngine ServiceDesk Plus 9.3 - User Enumeration Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine ServiceDesk Plus - 9.3 User enumeration vulnerability Exploit Author: Alexander Bluestein Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/service-desk/download.htm...