CVE-2018-6910

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...

CVE-2018-6910: Exposure of Resource to Wrong Sphere

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...

PT-2018-17818

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 Description The issue allows remote attackers to discover the full path of the system via a direct request for certain files, such as "include/downmix.inc.php" or "inc/inc archives functions.php". Recommendations For DedeCM...

Discuz! DiscuzX cross-site scripting vulnerability (CNVD-2018-02843)

Discuz! DiscuzX is an online forum system. A cross-site scripting vulnerability exists in Discuz! DiscuzX X3.4. A remote attacker can exploit this vulnerability by sending the 'op' parameter to the include\spacecp\spacecpupload.php file to inject arbitrary web script or HTML...

CVE-2018-5376

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpupload.php op parameter...

Design/Logic Flaw

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

CVE-2018-5376: Improper Neutralization of Input During Web Page Generation

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpupload.php op parameter...

CVE-2018-5375: Improper Neutralization of Input During Web Page Generation

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

PT-2018-16900

Name of the Vulnerable Software and Affected Versions DiscuzX version X3.4 Description The issue concerns a cross-site scripting XSS problem. It can be triggered via the view parameter in the include/space/space poll.php file. An example of exploitation is a request to home.php with mod=space and...

CVE-2017-17741

The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a writemmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h...

PT-2017-14981

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.14.8 Description The issue allows attackers to obtain potentially sensitive information from kernel memory. This is related to a write mmio stack-based out-of-bounds read in the KVM implementation, specifically...

UBUNTU-CVE-2017-17712

The rawsendmsg function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet-hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges...

PT-2019-8548

Name of the Vulnerable Software and Affected Versions noVNC versions prior to 0.6.2 Description A Cross-Site Scripting XSS issue was discovered in noVNC, where a remote VNC server could inject arbitrary HTML into the noVNC web page via messages propagated to the status field, such as the VNC serv...

WordPress WP Mobile Detector 3.5 Shell Upload Exploit

WP Mobile Detector Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /wp-content/plugins/wp-mobile-detector/resize.php script does contains a remote file include for files not cached by the system already. By uploading a...

SQL Injection Vulnerability in taoCMS Documentation Frontend

TaoCMS is the smallest around 100Kb fully functional CMS management system in China based on php+sqlite/mysql. taoCMS has a SQL injection vulnerability in the include/Model/Index.php file, which allows attackers to exploit the vulnerability to obtain sensitive database information...

UBUNTU-CVE-2017-15194

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

CVE-2017-15194: Improper Neutralization of Input During Web Page Generation

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

CVE-2016-10513

Cross Site Scripting XSS exists in Piwigo before 2.8.3 via a crafted search expression to include/functionssearch.inc.php...

CVE-2017-15194

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

PT-2017-13887

Name of the Vulnerable Software and Affected Versions Cacti version 1.1.25 Description The issue is related to XSS in the include/global session.php file. This is due to the handling of 1 the URI or 2 the refresh page. Recommendations For Cacti version 1.1.25, update to a version that includes a...