SQL Injection Vulnerability at CMS destination

Situ CMS is a self-developed website management system suitable for tourism website construction. A SQL injection vulnerability exists in CMS destination. The vulnerability is caused due to the system failing to strictly filter user input data. An attacker can exploit this vulnerability to obtain...

Updated nmap packages fix security vulnerability

Nmap developer nnposter found a security flaw directory traversal vulnerability in the way the non-default http-fetch script sanitized URLs. If a user manualy ran this NSE script against a malicious web server, the server could potentially depending on NSE arguments used cause files to be saved...

Unauthorized Write To Arbitrary Location

Hive HPL/SQL is vulnerable to unauthorized write to arbitrary location. FTP client in HPL/SQL fails to validate the download destination location for COPY FROM FTP statement, thereby allowing a malicious FTP server to run the command to download the file to any location...

Remote code execution

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how file copy destinations...

vlktravel.com XSS vulnerability

Open Bug Bounty ID: OBB-567869 Description| Value ---|--- Affected Website:| vlktravel.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Debian: Security Advisory (DLA-865-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DNS Traffic Capture: DNSCAP

dnscap is a network capture utility designed specifically for DNS traffic. It produces binary data in pcap3 and other format. This utility is similar to tcpdump1, but has a number of features tailored to DNS transactions and protocol options. DNS-OARC uses dnscap for DITL data collections. Some o...

FS Expedia Clone SQL Injection Vulnerability

FS Expedia Clone is an online travel reservation management system based on PHP and MySQL. The system supports booking of airline tickets, hotel reservations and car rentals via the Internet or telephone agents. A SQL injection vulnerability exists in FS Expedia Clone version 1.0. A remote attack...

CVE-2017-17570

FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php florig or fldest parameter...

CVE-2017-17584

FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php florig or fldest parameter...

[SECURITY] Fedora 25 Update: fedora-arm-installer-2.1-1.fc25

Allows one to first select a source image local or remote. The image must be a binary file containing: MBR + Partitions + File Systems + Data. A destination block device should then be selected for final installation...

[SECURITY] Fedora 26 Update: fedora-arm-installer-2.1-1.fc26

Allows one to first select a source image local or remote. The image must be a binary file containing: MBR + Partitions + File Systems + Data. A destination block device should then be selected for final installation...

Synology Router Manager Path Traversal Vulnerability

Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology. A directory traversal vulnerability exists in SYNO.FileStation.Extract in versions of SRM prior to 1.1.5-6542-4. A remote attacker can exploit this vulnerability to write arbitrary files with th...

[SECURITY] Fedora 27 Update: fedora-arm-installer-2.1-1.fc27

Allows one to first select a source image local or remote. The image must be a binary file containing: MBR + Partitions + File Systems + Data. A destination block device should then be selected for final installation...

CVE-2017-15895

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager SRM before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15893

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15894

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager DSM 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

SyncBreeze Enterprise Arbitrary Code Execution Vulnerability

SyncBreeze is a fast, powerful and reliable file synchronization solution for local disks, network shares, NAS storage devices and enterprise storage systems. An arbitrary code execution vulnerability exists in Flexense SyncBreeze Enterprise 10.1.16. An attacker can trigger a buffer overflow by...

CVE-2017-15950

Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the "Destination directory" field, either within an XML document or through use of passive mode...

kernel: ipv4: Invalid IP options could cause skb->dst drop

A vulnerability was found in the Linux kernel where having malicious IP options present would cause the ipv4pktinfoprepare function to drop/free the dst. This could result in a system crash or possible privilege escalation...