Command Execution Vulnerability in Oracle's Website Marketing System

Oxbridge Website Marketing System is an open source content management system, the product is based on PHP+MYSQL architecture, and can run on Windows, Linux, MacOSX, Solaris and other various platforms. Oxbones Website Marketing System has a command execution vulnerability that can be exploited b...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

✍️ Description In the repo online invoicing system i found a stored xss which gets exploited on member profile view which is lead by group name. 🕵️‍♂️ Proof of Concept Video POC: https://drive.google.com/file/d/1wUNY4BQyvI5RzutUn8T5KbTRMAIAZOlJ/view?usp=sharing Steps to reproduce: 1. Create a group...

Huawei EMUI/Magic UI DoS Vulnerability (CNVD-2021-64504)

Huawei Emui is an Android-based mobile operating system. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI is vulnerable to a DoS vulnerability, which can be exploited by attackers to cause a temporary denial of service...

ThinkPHP has a deserialization vulnerability

ThinkPHP is developed and maintained by the Shanghai Top Thinking company MVC structure of the open-source PHP framework. ThinkPHP has a deserialization vulnerability that can be exploited by attackers to gain server control privileges...

SQL Injection Vulnerability in Ai Qing Lemon CMS (CNVD-2021-49601)

Aizumi CMS is a php music website developed with php MySQL. Aizumi CMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

ArubaOS-Switch Ripple20 Multiple Vulnerabilities (ARUBA-PSA-2020-006)

The version of ArubaOS-Switch installed on the remote host is affected by multiple vulnerabilities in the Treck IP stack implementation. The vulnerabilities are collectively known as Ripple20, and can result in remote code execution, denial of service DoS, and information disclosure by remote,...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

Binary Vulnerability in OFD Version Reader of Beijing Numerical Network Technology Limited Liability Company (CNVD-2021-49108)

OFD plate reader is a plate reader product based on our own OFD standard. There is a binary vulnerability in OFD Edition Reader of Beijing Numerical Network Technology Co., Ltd. that can be exploited by attackers to cause the program to crash...

Binary Vulnerability in OFD Version Reader of Beijing Numerical Network Technology Limited Liability Company (CNVD-2021-49110)

OFD plate reader is a plate reader product based on our own OFD standard. There is a binary vulnerability in OFD Edition Reader of Beijing Numerical Network Technology Co., Ltd. that can be exploited by attackers to cause the program to crash...

Binary Vulnerability in OFD Version Reader of Beijing Numerical Network Technology Limited Liability Company (CNVD-2021-49111)

OFD plate reader is a plate reader product based on our own OFD standard. There is a binary vulnerability in OFD Edition Reader of Beijing Numerical Network Technology Co., Ltd. that can be exploited by attackers to cause the program to crash...

Autodesk Design Review Buffer Overflow Vulnerability (CNVD-2021-53947)

Autodesk Design Review ADR is a suite of AutoCAD drafting software assist software from Autodesk, Inc. The software supports viewing, marking, measuring, printing, and tracking changes to 2D and 3D design files.Autodesk Design Review is vulnerable to a buffer error vulnerability that could be...

Weak Password Vulnerability in Network Video Server of Shenzhen Longchamp Xintron Technology Co.

Shenzhen Longchamp Xintron Technology Co., Ltd. is a leading intelligent service robot solution provider in China. Ltd. Network Video Server has a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

Unauthorized Access Vulnerability in Online Fingerprint Time and Attendance System of Beijing Zhongcheng Technology Development Co.

Ltd. is a company in the field of time safety management, venture capital, green agriculture, mining extraction and OEM production. An unauthorized access vulnerability exists in the online fingerprint time and attendance system of Beijing Zhongguancun Technology Development Co. Ltd, which can be...

Unauthorized Access Vulnerability in RICOH MP C6004ex at Ricoh (China) Investment Co.

The MP C6004ex is a color digital laminator. An unauthorized access vulnerability exists in the MP C6004ex of Ricoh China Investment Limited, which can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in Hanvon Face Recognition Attendance Management System of Hanvon Technology Co.

Ltd. is committed to the research and application of intelligent interaction technology in multiple fields. A SQL injection vulnerability exists in the HANWANG Face Recognition Attendance Management System of HANWANG Technology Co. Ltd, which can be exploited by attackers to obtain sensitive...

AKCMS suffers from SQL injection vulnerability (CNVD-2021-46804)

AKCMS is a lightweight content management system based on PHP and MySQL. AKCMS suffers from an SQL injection vulnerability that can be exploited by attackers to obtain sensitive database information...

File upload vulnerability in HongCMS (CNVD-2021-46896)

HongCMS is a lightweight website system. A file upload vulnerability exists in HongCMS, which can be exploited by attackers to gain control of the server...

IBM DB2 Backlink Vulnerability

IBM DB2 is a relational database management system from the American company IBM. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM DB2 for Linux, UNIX, and Windows including DB2 Connect Server has a backlink vulnerability that can be exploit...

CVE-2021-23995

When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...