GLPI front/devicesoundcard.php file SQL injection vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. An SQL injection vulnerability exists in the front/devicesoundcard.php...

WordPress WP Security Audit Log plugin <= 2.4.3 - Reflected Cross-Site Scripting (XSS) Vulnerability

Reflected Cross-Site Scripting XSS Vulnerability exists in AjaxDisableCustomField function, in the file /wp-security-audit-log.php. The "notice" variable is printed on the front-end without escaping it. Solution Update the plugin...

DedeCMS stored xss vulnerability

Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function shopsdelivery. in php des parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the users cookie. Test environment: DedeCMS-V5...

Personalized User Focused Security: Stethoscope

Stethoscope is a web application that collects information from existing device data sources e.g., JAMF or LANDESK on a given user’s devices and gives them clear and specific recommendations for securing their systems. Stethoscope consists of two primary pieces: a Python-based back-end and a...

[SECURITY] Fedora 25 Update: cxf-3.1.6-5.fc25

Apache CXF is an open-source services framework that aids in the development of services using front-end programming APIs, like JAX-WS and JAX-RS...

GNU Chess Buffer Overflow Vulnerability

GNU Chess aka gnuchess is a chess program. A stack buffer overflow vulnerability exists in the ValidateMove function in the frontend/move.cc file in GNU Chess 6.2.3 and earlier. An attacker can exploit this vulnerability to execute arbitrary code with large input values...

Google Chrome < 56.0.2924.76 Multiple Vulnerabilities

Binary data 9935.pasl...

wordpress plugin front-end-post-edit cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin front-end-post-edit, which allows an attacker to frame...

Arbitrary Command Execution Vulnerability in Knight CMS

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS version 4.1.0 suffers from an arbitrary command execution vulnerability. Due to the Knight CMS V4.1.0 using the tp framework there is a template engine remote code execution vulnerability. Attackers can exploi...

Piwigo 'search_rules.php' Cross-Site Scripting Vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in the 'search results front end' feature in Piwigo version 2.8.3. A remote...

CVE-2016-9751

Cross-site scripting XSS vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter...

CVE-2016-9751: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter...

Stored Cross-Site Scripting Vulnerability in yiqicms

Yiqicms is a marketing enterprise website system based on SEO-friendly development, using PHP+Mysql open source building system. Yiqicms front-end stored cross-site scripting vulnerabilities. As the foreground to receive msgtitle msgname failed to filter the output code , only msgcotent parameter...

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions Information Disclosure Vulnerabilities

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions are Auto-Matrix USA's building automation front-end solutions for infrastructure, which are primarily deployed stateside in commercial facilities, critical manufacturing and energy and wastewater systems I&C. A...

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions File Containment Vulnerability

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions are Auto-Matrix USA's building automation front-end solutions for infrastructure, which are primarily deployed stateside in commercial facilities, critical manufacturing and energy and wastewater systems I&C. A...

CVE-2016-2308

American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application store passwords in cleartext, which allows remote attackers to obtain sensitive information by reading a file...

CVE-2016-2307

American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application allow remote attackers to read arbitrary files via unspecified vectors, as demonstrated by the configuration file...

CVE-2016-2308

The CVE-2016-2308 vulnerability affects American Auto-Matrix Building Automation Front-End Solutions (Aspect-Nexus and Aspect-Matrix) applications prior to version 3.0.0, where passwords are stored in clear text. This enables a remote attacker to read sensitive information from a file on the host...

CVE-2016-2308: Undefined Security Weakness

American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application store passwords in cleartext, which allows remote attackers to obtain sensitive information by reading a file...

CVE-2016-2307: Exposure of Sensitive Information to an Unauthorized Actor

American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application allow remote attackers to read arbitrary files via unspecified vectors, as demonstrated by the configuration file...