9665 matches found
SQL Injection Vulnerability in Zendo 9.1.2 zentao\lib\base\dao\dao.class.php Page
Zendo is an open source project management software. Zendo project management software version 9.1.2 zentao\lib\base\dao\dao.class.php page SQL injection vulnerability. The orderBy function fails to filter the data submitted by the user, allowing an attacker to exploit the vulnerability to obtain...
Researchers Disclose Intel AMT Flaw Research
On Friday, just as Intel released additional information regarding a critical flaw found earlier this week in a subset of its business-class PCs, the researchers behind the initial vulnerability discovery, Embedi, also published their research on the flaw. Intel warned Monday of a firmware...
EulerOS 2.0 SP1 : python (EulerOS-SA-2016-1036)
According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the Python CGIHandler class did not properly protect against the HTTPPROXY variable name clash in a CGI context. A remote...
SQL injection vulnerability in cid parameter of Fangfa CMS FcontentAction.class.php page
Fangfa CMS is a scalable web content management software. A SQL injection vulnerability exists in the cid parameter of the Fangfa CMS V4.0 FcontentAction.class.php page, which can be exploited by an attacker to obtain sensitive information from the database...
Local File Inclusion (LFI) Vulnerability
axis2 is vulnerable to a local file inclusion LFI vulnerability. It does not prevent the adding of the root directory of the binary distribution to the class path by axis2server.sh. Also the search for XSD/WSDL files is not limited to the service class loader by SimpleHTTPServer which allows...
Debian DLA-910-1 : libreoffice security update
CVE-2017-3157 Ben Hayak discovered that objects embedded in Writer and Calc documents may result in information disclosure. Please see https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157 / for additional information. CVE-2017-7870 An out-of-bounds write caused by a heap-based...
PT-2017-17890
Name of the Vulnerable Software and Affected Versions SquirrelMail versions prior to 20170427 0200-SVN Description The issue allows post-authentication remote code execution via a mishandled sendmail.cf file in a popen call. This can be exploited to execute arbitrary shell commands on the remote...
IHG Confirms Second Credit Card Breach Impacting 1,000-Plus Hotels
In what’s becoming a familiar refrain to guests, InterContinental Hotels Group, said late last week that payment card systems at more than 1,000 of its hotels had been breached. It’s the second breach that IHG, a multinational hotel conglomerate that counts Holiday Inn and Crowne Plaza among its...
CVE-2016-1155
HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies...
CVE-2016-4800
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...
CVE-2016-4800
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...
CVE-2016-4800
CVE-2016-4800 affects Eclipse Jetty 9.3.x prior to 9.3.9 on Windows. The path normalization in PathResource can be bypassed via a URL containing certain escaped characters (backslashes), allowing an attacker to bypass protected resource restrictions and other security constraints. The description...
CVE-2016-4800
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...
CVE-2016-1155: Improper Neutralization of Special Elements in Output Used by a Downstream Component
HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies...
OXID eSales OXID eShop Security Bypass Vulnerability
OXID eSales OXID eShop is a set of e-commerce content management system of Germany OXID eSales company. The system includes B2C, B2B and other modules. A security bypass vulnerability exists in OXID eSales OXID eShop. A remote attacker can exploit this vulnerability by sending a GET or POST reque...
PHPCMS v9. 6. 0 arbitrary file upload vulnerability analysis-vulnerability warning-the black bar safety net
Author: p0wd3r know Chong Yu 404 security lab Date: 2017-04-12 0x00 vulnerability overview Vulnerability description A few days ago phpcms v9. 6 arbitrary file upload vulnerability caused by a safety ring hot, by the vulnerability the attacker may be in the unauthorized case any file is uploaded,...
CVE-2017-3058
Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable use after free vulnerability in the sound class. Successful exploitation could lead to arbitrary code execution...
CVE-2017-3063
Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable use after free vulnerability in the ActionScript2 NetStream class. Successful exploitation could lead to arbitrary code execution...
