Privilege Escalation

Contao is susceptible to privilege escalation. The attack exists because it lacks the check to control the back end users from accessing details view URL to show restricted pages and articles...

CVE-2019-19745

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...

Design/Logic Flaw

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...

CVE-2019-19745

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...

CVE-2019-19745

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...

CVE-2019-19712

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them...

CVE-2019-19712

Contao CMS vulnerability CVE-2019-19712 affects Contao 4.0–4.8.5 where backend users can manipulate the details view URL to reveal pages/articles not enabled for them, indicating an information-disclosure issue due to insecure permissions in the backend. Affected versions include 4.0 through 4.8....

CVE-2019-19712

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them...

Information disclosure in the back end

Date : 2019-12-17 CVE ID : CVE-2019-19712 Description Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.45 Contao 4.5 Contao 4.6 Contao 4.7 Contao 4....

CVE-2019-19712: Incorrect Default Permissions

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them...

CVE-2019-4387: Improper Neutralization of Special Elements used in an SQL Command

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 162715...

CVE-2019-16207

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges...

CVE-2019-16207: Use of Hard-coded Credentials

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges...

TYPO3 SQL Injection Vulnerability (CNVD-2019-40296)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A SQL injection vulnerability exists in the back-end of TYPO3, which stems from a lack of validation of externally entered SQL statements in database-based applications and can be exploited...

SQL injection vulnerability in the de*** method of the ad***_ne***.php file in the backend of seacms

seacms ocean film and television management system, ocean cms is based on PHP + MySql technology development of video on demand system. seacms background adne.php file de method exists SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

VMSA-2019-0019 : Denial-of-service vulnerability

ESXi shader denial-of-service vulnerability - CVE-2019-5536 VMware ESXi, Workstation and Fusion contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on...

B2R2 - Collection Of Useful Algorithms, Functions, And Tools For Binary Analysis

B2R2 is a collection of useful algorithms, functions, and tools for binary analysis , written purely in F in .NET lingo, it is purely managed code. B2R2 has been named after R2-D2, a famous fictional robot appeared in the Star Wars. In fact, B2R2's original name was B2-R2 , but we decided to use...

VMSA-2019-0014 : Use-after-free vulnerability

ESXi use-after-free vulnerability - CVE-2019-5527 ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. A local attacker with non-administrative access on the guest machine may exploit this issue to execute code on the host. This...

CVE-2019-4147

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413...

Sql injection

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413...