Apache Tomcat 'UTF-8' Directory Traversal Vulnerability - Active Check

Apache Tomcat is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2018-18546

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable...

Sql injection

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable...

CVE-2018-18546

CVE-2018-18546 affects ThinkPHP 3.2.4. The vulnerability is an SQL Injection via the order parameter caused by mishandling of the key in Library/Think/Db/Driver.class.php parseOrder. Public CVSS details indicate high to critical impact (CVSS2 base 7.5; CVSS3 base 9.8). Exploitation details are no...

PT-2018-14506

Name of the Vulnerable Software and Affected Versions ThinkPHP version 3.2.4 Description The issue is related to SQL Injection via the order parameter. This occurs because the parseOrder function in the Library/Think/Db/Driver.class.php file mishandles the key variable. Recommendations For ThinkP...

CVE-2018-18546: Improper Neutralization of Special Elements used in an SQL Command

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable...

CVE-2018-18529

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

CVE-2018-18529

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

CVE-2018-18529

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

PT-2018-14497

Name of the Vulnerable Software and Affected Versions ThinkPHP version 5.1.25 Description The issue is related to SQL Injection via the count parameter. This occurs because the library/think/db/Query.php aggregate function mishandles the aggregate variable. The attack requires a backquote charact...

PT-2018-14496

Name of the Vulnerable Software and Affected Versions ThinkPHP version 3.2.4 Description The issue is related to SQL Injection via the count parameter. This occurs because the parseKey function in the Library/Think/Db/Driver/Mysql.class.php file mishandles the key variable. It is noted that a...

SUSE-SU-2018:2081-2 Security update for xen

This update for xen fixes the following issues: Security issues fixed: - CVE-2018-12891: Fix preemption checks bypass in x86 PV MM handling XSA-264 bsc1097521. - CVE-2018-12892: Fix libxl failure to honour readonly flag on HVM emulated SCSI disks XSA-266 bsc1097523. - CVE-2018-12893: Fix DB...

CVE-2018-18485: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock...

PT-2018-14485

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter in the "admin.php?mod=db&act=del" API endpoint. This can be leveraged to...

FLIR AX8 Thermal Camera 1.32.16 - Arbitrary File Disclosure Vulnerability

Exploit for hardware platform in category web applications Exploit Title: FLIR AX8 Thermal Camera 1.32.16 - Arbitrary File Disclosure Auhor: Gjoko 'LiquidWorm' Krstic Date: 2018-10-14 Vendor: FLIR Systems, Inc. Product web page: https://www.flir.com Affected version: Firmware: 1.32.16, 1.17.13 OS...

Free MP3 CD Ripper 2.8 - '.wma' Buffer Overflow (SEH) (DEP Bypass)

Exploit Title: Free MP3 CD Ripper 2.8 - '.wma' Buffer Overflow SEH DEP Bypass Date: 2018-10-08 Exploit Author: Matteo Malvica Vendor: Cleanersoft Software Software Link: http://www.commentcamarche.net/download/telecharger-34082200-free-mp3-cd-ripper Tested Version: 2.8 Tested on OS: Windows 7 -...

SUSE-SU-2018:3016-1 Security update for php7

This update for php7 fixes the following issues: This security issue was fixed: - CVE-2018-17082: The Apache2 component in PHP allowed XSS via the body of a 'Transfer-Encoding: chunked' request, because the bucket brigade was mishandled in the phphandler function bsc1108753 This non-security issu...

CVE-2014-10076

CVE-2014-10076 affects the WordPress plugin WP-DB-Backup (v2.2.4). The vulnerability arises because access control relies on a five-character string, enabling remote attackers to read backup archives via brute-force. Documents consistently describe this as a credential/authorization weakness allo...

PT-2018-4165

Name of the Vulnerable Software and Affected Versions wp-db-backup plugin version 2.2.4 Description The issue allows remote attackers to read backup archives via a brute-force attack due to the plugin relying on a short string for access control. Recommendations For wp-db-backup plugin version...

CVE-2014-10076: Exposure of Sensitive Information to an Unauthorized Actor

The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack...