SQL Injection Vulnerability in Ocean CMS Backend

Ocean CMS is a web content management system based on PHP+MYSQL architecture that can run across platforms. There is a SQL injection vulnerability in the backend of Ocean CMS, which can be exploited by attackers to obtain sensitive database information...

CVE-2020-10725

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity chec...

UBUNTU-CVE-2020-10725

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity chec...

Code Execution Vulnerability in the Backend of Daimi CMS

DAMI CMS is a PC building station and cell phone building station integrated all-in-one system. A code execution vulnerability exists in the background of Daimi CMS, which can be exploited by attackers to gain server privileges...

Weak Password Vulnerability in Network Video Server of Longchamp Cintron

Ltd. is a provider of products and application solutions in the field of network video surveillance in China. A weak password vulnerability exists in the network video server, which can be exploited by an attacker to log in to the backend of the system...

SQL Injection Vulnerability in ejucms Backend

EJU real estate system ejucms is a set of localized O2O real estate website platform system. ejucms background SQL injection vulnerability, attackers can exploit the vulnerability to obtain database sensitive information...

Command Execution Vulnerability in ejucms Backend Templates

EJU real estate system ejucms is a set of localized O2O real estate website platform system. ejucms background template command execution vulnerability, attackers can exploit the vulnerability to obtain server privileges...

KKCMS backend suffers from sql injection vulnerability

kkcms is an open source video capture and playback system. KKCMS backend suffers from sql injection vulnerability. Attackers can use the vulnerability to obtain sensitive information in the database...

SQL Injection Vulnerability in iOffice M2 Backend Management System

iOffice M2 background management system is an office software developed by Guangzhou Hongfan Computer Technology Co. iOffice M2 background management system exists SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

Cross-site Scripting (XSS)

typo3/cms is susceptible to cross-site scripting XSS. The attack is possible because of lack of sanitization of HTML placeholder attributes, allowing a valid backend user account to inject malicious scripts via the attributes and get executed when a user visits the page...

Insecure Deserialization

typo3/cms-core is vulnerable to insecure deserialization. The vulnerability exists as $BEUSER-uc in the backend settings is not properly handled...

CVE-2020-11067

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings in $BEUSER-uc are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user...

CVE-2020-11069

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...

CVE-2020-11067

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings in $BEUSER-uc are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user...

Deserialization of untrusted data

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings in $BEUSER-uc are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user...

Cross site request forgery (csrf)

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...

File upload vulnerability in weiphp backend

WeiPHP is a convenient and scalable open source WeChat public platform development framework, using it you can easily build a own WeChat public platform. weiphp backend file upload vulnerability, attackers can use the vulnerability to upload malicious files, get server privileges...

TYPO3 Direct Mail Component Information Disclosure Vulnerability (CNVD-2020-28942)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the Direct Mail component of TYPO3 5.2.3 and prior versions, which originates from the program's inability to check whether an authenticated back-end user...

FreeBSD : typo3 -- multiple vulnerabilities (59fabdf2-9549-11ea-9448-08002728f74c)

Typo3 News : CVE-2020-11063: TYPO3-CORE-SA-2020-001: Information Disclosure in Password Reset It has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to verify whether a backend user account with a given email...

CVE-2020-11069 Cross-Site Request Forgery in TYPO3 CMS

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...