10897 matches found
Design/Logic Flaw
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php244 makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend pat...
joyplus-cms cross-site scripting vulnerability (CNVD-2018-14238)
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in...
[SECURITY] Fedora 28 Update: evolution-data-server-3.28.4-1.fc28
The evolution-data-server package provides a unified backend for programs t hat work with contacts, tasks, and calendar information. It was originally developed for Evolution hence the name, but is now used by other packages...
LocalTapiola: F5 BigIP Backend Cookie Disclosure
Basic report information Summary: The Same issue was reported on www.myynti.lahitapiolarahoitus.fi by another reporter. It was fixed for that. But when I test the same issue on lahitapiolarahoitus.fi. It is also causing leakage of information. Description: I just identify F5 BigIP load balancers...
joyplus-cms SQL Injection Vulnerability
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A SQL injection vulnerability exists in joyplus-c...
SQL Injection Vulnerability in V1.7 Backend of School Worry-free Enterprise Building System
School carefree enterprise website system Xiao5uCompany is a set of company and enterprise-oriented website building system. SQL injection vulnerability exists in the background of XiaowuCompany V1.7. An attacker can exploit the vulnerability to obtain sensitive information from the database...
CVE-2016-6566
The valueAsString parameter inside the JSON payload contained by the ucLogintxtLoginIdClientStat POST parameter of the Sungard eTRAKiT3 software version 3.2.1.17 is not properly validated. An unauthenticated remote attacker may be able to modify the POST request and insert a SQL query which may...
Design/Logic Flaw
The valueAsString parameter inside the JSON payload contained by the ucLogintxtLoginIdClientStat POST parameter of the Sungard eTRAKiT3 software version 3.2.1.17 is not properly validated. An unauthenticated remote attacker may be able to modify the POST request and insert a SQL query which may...
CVE-2016-6566 The Sungard eTRAKiT3 software version 3.2.1.17 may be vulnerable to SQL injection which may allow a remote unauthenticated attacker to run a subset of SQL commands against the back-end database
The valueAsString parameter inside the JSON payload contained by the ucLogintxtLoginIdClientStat POST parameter of the Sungard eTRAKiT3 software version 3.2.1.17 is not properly validated. An unauthenticated remote attacker may be able to modify the POST request and insert a SQL query which may...
Insecure Deserialization in TYPO3 CMS
It has been discovered that the Form Framework system extension "form" is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting...
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
Phar files formerly known as "PHP archives" can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt...
NUCMS V1.1 SQL Injection Vulnerability in Backend
NUCMS content management system is an open source website management system. NUCMS V1.1 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...
Faraday Beta v3.0 - Collaborative Penetration Test and Vulnerability Management Platform
This new version has made major architectural changes to adapt the software to the new challenges of cybersecurity. It focuses on processing large volumes of data and facilitating user interaction with Faraday in their environment. Faraday just got much faster Architecture changes and a new...
Radancy: I can subscribe and unsubscribe any user with the same token for as many times as i want
During the subscription process for a newsletter it was possible to enter any email-address which would automatically be added to the emaillist without proper confirmation via a confirmation token send by email. Same for the unsubscription process, anyone could unsubscribe all emailaddress becaus...
SQL Injection Vulnerability in Shanghai Siting's WeChat Backend Management System
Ltd. is mainly committed to the automotive industry information technology software solutions, the main object of service are automobile OEMs, dealer groups, 4S stores and a variety of fast repair chain institutions and a series of customers. SQL injection vulnerability exists in the WeChat backe...
New Web CMS suffers from an override access vulnerability
Linyi Xinnet Network Technology Co., Ltd. is a network application service provider for the majority of government and enterprises and institutions to provide enterprise website construction, website optimization, network promotion, Linyi SEO, mobile station, micro letter marketing, domain name...