Jenkins groovy.util.Expando Java deserialization vulnerability

Added: 08/15/2017 CVE: CVE-2016-0792 BID: 83720 Background Jenkins is a standalone, open-source automation server written in Java. Problem A deserialization vulnerability in the groovy.util.Expando class allows a remote attacker to execute arbitrary commands by requesting createItem with speciall...

JDK: class verifier allowing Security Manager bypass

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873...

[SECURITY] Fedora 25 Update: php-horde-Horde-Url-2.2.6-1.fc25

This class represents a single URL and provides methods for manipulating URLs...

SQL Injection Vulnerability in ourphp v1.7.3 ourphp_play.class.php Page

OurPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. A SQL injection vulnerability exists in the ourphp v1.7.3 ourphpplay.class.php page. An attacker can exploit this vulnerability to obtain sensitive database informati...

CVE-2015-0783

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

CVE-2015-0782

SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management ZCM allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management ZCM allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Design/Logic Flaw

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

CVE-2015-0783

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

CVE-2015-0781: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management ZCM allows remote attackers to upload and execute arbitrary files via unspecified vectors...

CVE-2015-0782: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management ZCM allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2019-5314

Name of the Vulnerable Software and Affected Versions Log4j versions 1.2 up to 1.2.17 Description The issue is related to the deserialization of untrusted data in the SocketServer class of Log4j 1.2, which can be exploited to remotely execute arbitrary code when combined with a deserialization...

Artificial Inteligent Packet Inspection Engine: AIEngine

AIEngine is a next generation interactive/programmable Python/Ruby/Java packet inspection engine with capabilities of learning without any human intervention, NIDS Network Intrusion Detection System functionality, DNS domain classification, network collector, network forensics and many others...

WSTMall open source mall system LogLoginsAction.class.php exists SQL injection vulnerability

WSTMall is a multi-commercial O2O open source system developed by Merchant Software based on thinkphp, a system that can help businesses and individuals to quickly build a community service system. WSTMall open source mall system LogLoginsAction.class.php has a SQL injection vulnerability due to...

CVE-2017-12139: Improper Neutralization of Input During Web Page Generation

XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php...

SQL injection vulnerability in class parameter of Interactive Creation website building system

Interactive Creative Xiamen Digital Technology Co., Ltd. is a brand website construction company in Fujian Province, "Interactive Creative" is one of its independent brands. A SQL injection vulnerability exists in the class parameter of Interactive Creative's website building system. An attacker...

CVE-2017-11324

An issue was discovered in Tilde CMS 1.0.1. Due to missing escaping of the backtick character, a SELECT query in class.SystemAction.php is vulnerable to SQL Injection. The vulnerability can be triggered via a POST request to /actionphp/action.input.php with the id parameter...

CVE-2017-11422

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc...

CVE-2017-11422

CVE-2017-11422 affects Statamic framework prior to 2.6.0, where session permission checks are insufficient when methods from a user’s class are invoked (e.g., reset password, create account, create role). This can allow actions beyond intended privileges. The issue is fixed in 2.6.0; upgrade to t...

GLPI '$crit' Variable SQL Injection Vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A SQL injection vulnerability exists in the '$crit' variable in the...