Youk365 Classifieds navigation system cate_deion parameter has sql injection vulnerability

Uc365 website classification and navigation system is a cross-platform open source software, you can build up a classified directory or website navigation site. The catedeion parameter of the Uke365 classifieds navigation system suffers from a sql injection vulnerability. Allow attackers to explo...

CVE-2017-6059

A text injection flaw was found in how modauthopenidc handled error pages. An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs...

Itech B2B Script SQL Injection Vulnerability (CNVD-2017-01854)

B2B Script v4.29 is a versatile WEB solution for those who want to quickly publish their B2B portals in minutes. A SQL injection vulnerability exists in the 'id' field in the buyleads-details.php page in B2B Script v4.29, which can be exploited by an attacker to obtain sensitive information from...

Cybozu Garoon vulnerable to SQL injection

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an SQL injection vulnerability CWE-89 due to an issue in "MultiReport" function. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc...

Design/Logic Flaw

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...

Command Injection Vulnerability in Huawei FusionAccess

Huawei FusionAccess is a desktop management system for Huawei's FusionCloud desktop cloud solution from Huawei, China. The system distributes, maintains, and recycles virtual desktops for users through a graphical Portal interface. A command injection vulnerability exists in Huawei FusionAccess...

BigTree CMS SQL Injection Vulnerability

BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A SQL injection vulnerability exists in versions of Bigtree Cms prior to 4.1.16, which stems from the program failing to adequately filter user-submitted input. An attacker can...

SUSE-SU-2016:2653-1 Security update for python3

This update provides Python 3.4.5, which brings many fixes and enhancements. The following security issues have been fixed: - CVE-2016-1000110: CGIHandler could have allowed setting of HTTPPROXY environment variable based on user supplied Proxy request header. bsc989523 - CVE-2016-0772: A...

UCenter Home cp_magic.php suffers from SQL injection vulnerability

UCenter Home is a set of social network software Social Network Software, abbreviated as SNS built with PHP+MYSQL. A SQL injection vulnerability exists in UCenter Home cpmagic.php. Because the program fails to filter user input, an attacker can obtain sensitive database information by submitting...

Joomla! com_enmasse Component SQL Injection Vulnerability

Joomla! is an open source content management system CMS. The system provides RSS feeds , site search and other functions . A SQL injection vulnerability exists in the term?tmpl page id parameter of the Joomla!comenmasse component, which can be exploited by an attacker to compromise the applicatio...

Zend Framework vulnerable to SQL injection

Overview Zend Framework is an open source web application framework. Zend Framework 1 contains an SQL injection vulnerability CWE-89 due to a flaw in processing parameters in the ORDER BY and GROUP BY clauses. Hiroshi Tokumaru of HASH Consulting Corp. reported this vulnerability to IPA. JPCERT/CC...

SQL Injection Vulnerability in the id parameter of the /www/index.php page of Xiyu Media's Digital Newspaper System

Joy Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. There is a SQL injection vulnerability in this product, the vulnerability URL is: /www/index.php?mod=admin&con=review&act=view&id=, the vulnerability parameter is: id, the attacker can use the vulnerability t...

Command Execution Vulnerability in Huawei UMA

Huawei UMA Unified Maintenance Audit is a unified audit system. It provides a unified O&M operation portal, controls and records O&M operations performed by users, and supports auditing by command view and video playback. A command execution vulnerability exists in Huawei UMA. As the system does...

SQL Injection Vulnerability in Flash Flood Monitoring and Early Warning Platform of Fujian SiChuang Software Co.

Fujian SiChuang Software Co., Ltd. flash flood disaster monitoring and early warning platform is mainly for flood control command system, flash flood disaster early warning system and other products, has been widely used in the Ministry of Water Resources Basin Committee and the provinces and...

setroubleshoot-plugins: insecure commands.getoutput use in the allow_execstack plugin

A shell command injection flaw was found in the way the setroubleshoot allowexecstack plugin executed external commands. A local attacker able to trigger an execstack SELinux denial could use this flaw to execute arbitrary code with root privileges...

Generalized SQL Injection Vulnerability in Flow Control Routing of CoQin Technology

Since its inception over 15 years ago, Co-Tech has evolved from a manufacturer of high-end modems to a strong competitor in the broadband solutions space. A generalized SQL injection vulnerability exists in the flow control routing of Welkin Technologies. It allows attackers to utilize commonly...

DotCMS Workflow Screen SQL Injection Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A SQL injection vulnerability exists in Workflow Screen in DotCMS versions prior to 3.3.2. A remote attacker ca...

Yeager SQL Injection Vulnerability

Yeager is an open source content management system . Yeager has a SQL injection vulnerability that allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain database data...

The Ceph Object Gateway CRLF Vulnerability(CVE-2 0 1 5-5 2 4 5)-vulnerability warning-the black bar safety net

CVECAN ID: CVE-2 0 1 5-5 2 4 5 The Ceph Object Gateway is constructed in the librados on top of the object storage interface, you can make the application through a RESTful gateway to access the distributed storage system Ceph Storage Clusters. Ceph 0.94.4 before the version, Ceph Object Gateway,...

Shandong Nongyou Agricultural Integrity System SQL Injection Vulnerability

Shandong Nongyou Agricultural Integrity System is an agricultural management system. The Agricultural Integrity System suffers from SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...