Trend Micro Encryption for Email Gateway emailSearch SearchString SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL statements on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exist...

SQL Injection Vulnerability in UQCMS Cloud Business B2B2C Multi-store System Version V1.3.2_20180309

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. UQCMS cloud business B2B2C multi-store system goodsact.class page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

Quest NetVault Backup NVBUEventHistory Get Method SQL Injection (CVE-2017-17412)

An SQL injection vulnerability exists in the Server Process Manager Service of Quest NetVault Backup. The vulnerability is due to improper validation of user-supplied input on JSON-RPC requests invoking the Get method of the NVBUEventHistory class...

RHEL 6 / 7 : jboss-ec2-eap package for EAP 7.1.2 (Important) (RHSA-2018:1249)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1249 advisory. The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services AWS...

phpLiteAdmin Design Vulnerability

phpLiteAdmin is a software developer Dane Iracleous developed a set of PHP implementation and Web-based open-source SQLite database management tool . A security vulnerability exists in phpLiteAdmin versions 1.9.5 through 1.9.7.1, which stems from a failure of the program to perform an accurate...

DEBIAN-CVE-2018-10362

An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-provided login password, it is possible to login with a simpler password if the password has the form of a power in scientific notation like...

Apple iOS Telephony Denial of Service Vulnerability

Apple iOS is an operating system developed by Apple Inc. for mobile devices.APNs are a component of the push notification service.Telephony is a component that provides telephony capabilities. A security vulnerability exists in the Telephony component in Apple iOS versions prior to 11.3. A remote...

SQL Injection Vulnerability in phpComasy CMS System

phpComasy CMS is a foreign open source content management system, with simple and fast, scalable, is the ideal system for small and medium-sized websites. phpComasy CMS V2.1.1 A SQL injection vulnerability exists in the phpcomasy\classes\class.management.php file, which can be exploited by an...

Exiv2 IptcData::printStructure Out-of-Bounds Read Vulnerability

Exiv2 is a C++ library for extracting EXIF, LPTC and XMP metadata information from images. An out-of-bounds read security vulnerability exists in Exiv2 version 0.26 iptc.c/IptcData::printStructure, which can be exploited by attackers to cause a crash or information disclosure...

CVE-2016-10430: Exposure of Sensitive Information to an Unauthorized Actor

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, when executing a TA which has been granted privileges to the CPVC MINK class it is possible for the TA to access...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2018-949)

SingleEntryRegistry incorrect setup of deserialization filter JMX, 8186998 It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass intended...

Oracle Java MethodHandles tryFinally Type Confusion Sandbox Escape Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation o...

SQL injection vulnerability in admin.class.php page of UQCMS Cloud B2B2C multi-store system

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. UQCMS cloud business B2B2C multi-store system admin.class.php page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

SQL injection vulnerability in the bill.class.php page of UQCMS Cloud Business B2B2C Multi-store System

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. UQCMS cloud business B2B2C multi-store system bill.class.php page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

CVE-2018-10119

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service use-after-free with write access or possibly have unspecified other impact via a crafted...

CVE-2018-9922

An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.php pathname...

Code Execution Vulnerability in Gxlcms News System DataAction.class.php

Gxlcms News System is a news cms content management system developed in php+mysql. A code execution vulnerability exists in DataAction.class.php of Gxlcms News System. An attacker can exploit the vulnerability to obtain a webshell...

SQL Injection Vulnerability in Gxlcms News System AdsAction.class.php

Gxlcms News System is a news cms content management system developed in php+mysql. A SQL injection vulnerability exists in Gxlcms News System AdsAction.class.php. An attacker can exploit the vulnerability to obtain sensitive database information...

Directory traversal

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request...

GxlcmsQY Arbitrary PHP Code Execution Vulnerability

GxlcmsQY system is a quick website cms tailored for business users. An arbitrary PHP code execution vulnerability exists in the upload function in LibLibActionAdminUploadAction.class.php in GxlcmsQY v1.0.0713. A remote attacker can exploit this vulnerability by first changing the configuploadclas...