10897 matches found
Trovebox SQL Injection Vulnerability
Trovebox is an open source image sharing and management platform. album is one of the album components. A SQL injection vulnerability exists in the album component in Trovebox versions prior to 4.0.0-rc6. A remote attacker can exploit this vulnerability by sending an HTTP request to view, add,...
dpdk: Information exposure in unchecked guest physical to host virtual address translations
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory...
Universal password login vulnerability in Suzhou Kodak's security monitoring video platform.
MSS Streaming Media Server is a surveillance video streaming platform from Suzhou Kodak Technology Co. A universal password login vulnerability exists in the Suzhou KODAK Security Surveillance Video Platform. An attacker can utilize the vulnerability to log in to the backend, view all video files...
Code execution vulnerability in weiphp 2.0 system backend
WeiPHP is an open source WeChat public platform development framework to build a personal WeChat public account operation platform. A code execution vulnerability exists in the weiphp 2.0 backend, which can be exploited by attackers to execute code and thus gain control of the server...
GNOME Evolution Evolution-Data-Server Buffer Overflow Vulnerability
GNOME Evolution is a set of mail client programs from the GNOME project for the Gnome desktop environment on Linux. The program provides Email, calendar, meeting scheduling, contact management, etc. Evolution-Data-Server is one of the data server components. A buffer overflow vulnerability exists...
Open-Xchange OX App Suite Backend Component Information Disclosure Vulnerability
Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A security vulnerability exists in a back-end component in Open-Xchange OX App Suite. A remote attacker could exploi...
Security Bulletin: IBM SmartCloud Orchestartor - Trustee token revocation does not work with memcache backend (CVE-2014-2237)
Summary When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This scenario results in the trust token not being invalidated by the trustee's token revocation bulk revocation. It is most noticeable...
Security Bulletin: Multiple Security Vulnerabilities have been addressed in LCMS Premier on Cloud 10.1
Summary Multiple Security Vulnerabilities have been addressed in LCMS Premier on Cloud 10.1 Vulnerability Details Relevant CVE Information: CVEID: CVE-2016-5952 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL...
Security Bulletin: IBM Maximo Asset Management is vulnerable to SQL injection (CVE-2018-1414)
Summary IBM Maximo Asset Management is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2018-1414 DESCRIPTION: IBM Maximo...
Open redirect
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...
DEBIAN-CVE-2018-12422
addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the...
CVE-2018-12422
addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the...
UBUNTU-CVE-2018-12422
addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the...
QSC18 Virtual Edition – Building Security In: The Qualys Cloud Platform and Architecture
Digital transformation, driven primarily by the DevOps movement, represents a new opportunity “to redo IT from scratch, but more importantly, to redo security from scratch,” Sumedh Thakar, Qualys' Chief Product Officer, said during QSC18 Virtual Edition. Specifically, organizations can organicall...
ArticleSetup Login Bypass Vulnerability
ArticleSetup is an article publishing management system based on PHP language . A login bypass vulnerability exists in the backend login function of ArticleSetup version 1.00, which can be exploited by an attacker to log in to the system directly as an administrator...
PT-2018-11161 · Gnome +1 · Gnome Evolution +1
Name of the Vulnerable Software and Affected Versions: GNOME Evolution versions through 3.29.2 Description: The issue might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function in the e-book-backend-ldap.c file. However, the software maintainer...
BlackCat CMS Cross-Site Scripting Vulnerability (CNVD-2018-14549)
BlackCatCMS is an open source content management system CMS that supports both English and German. A cross-site scripting vulnerability exists in the backend/pages/modify.php file in BlackCatCMS version 1.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML v...
Updated scummvm packages fix security vulnerability
Updated scummvm package fixes security vulnerability ScummVM 1.8.1's POSIX backend does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL CVE-2017-17528. This...
SQL Injection Vulnerability in Apple CMS-V7 Backend Get Info Interface
Apple CMS program is a perfect and powerful rapid website building system running on PHP+MYSQL environment. There is a SQL injection vulnerability in the backend interface of Apple CMS-V7 version to obtain information. The reason for the vulnerability stems from the fact that the program does not...