CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

UCMS SQL Injection Vulnerability

UCMS is a content management system written in PHP. A SQL injection vulnerability exists in the install/index.php file in UCMS version 1.4.6. A remote attacker can exploit this vulnerability to execute SQL commands with the help of the 'mysqldbname' parameter...

RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

IBM Maximo Asset Management SQL Injection Vulnerability (CNVD-2018-17089)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. An SQL injectio...

CVE-2018-15904

A10 ACOS Web Application Firewall WAF 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.1.2-P4 mishandles the configured rules for blocking SQL injection attacks, aka A10-2017-0008...

WordPress Plugin Chained Quiz SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Chained Quiz, which can be exploited by attackers to execute...

SQL Injection Vulnerability in Website Building System of Shanghai Bonning Network Technology Co.

Shanghai Bonning Network Technology Co., Ltd. is a company dedicated to the application and promotion of website building and e-commerce for enterprises and institutions. Shanghai Bonning Network Technology Co., Ltd. website building system has SQL injection vulnerability, attackers can use the...

DEBIAN-CVE-2018-12482

OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues...

IBM InfoSphere Data Replication Dashboard SQL Injection Vulnerability

IBM InfoSphere Data Replication Dashboard is a data synchronization solution from IBM USA. The solution enables log-based data change capture through real-time replication and provides features such as trusted data integration and synchronization. A SQL injection vulnerability exists in IBM...

ELO ELOenterprise and ELOprofessional Access Manager Component SQL Injection Vulnerability

ELO is ELO Digital Office's document management system. eloenterprise is its enterprise version; eloprofessional is its professional version. access manager is one of the access managers. A SQL injection vulnerability exists in the HTTP GET parameter 'ticket' of the Access Manager component in EL...

CVE-2018-10197

There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELOenterprise 9 and 10 and ELOprofessional 9 and 10 that makes it possible to read all database content. The vulnerability exists in the ticket HTTP GET...

SQL Injection Vulnerability in Azeus CMS

Azeus CMS is a cms system made by Azeus Studio, this CMS is written in UTF-8 coding. SQL injection vulnerability exists in Azeus CMS. An attacker can exploit the vulnerability to obtain sensitive information from the database...

CVE-2018-12532

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...

JBoss RichFaces Arbitrary Java Code Execution Vulnerability

Red Hat JBoss RichFaces is the United States Red Hat Red Hat, Inc. of an open source JSF JavaServer Faces component library . The library provides built-in JavaScript and Ajax functionality . A security vulnerability exists in Red Hat JBoss RichFaces versions 3.1.0 through 3.3.4. A remote attacke...

NodAPS 'search' SQL Injection Vulnerability

NodAPS is an online appointment management system available in multiple languages and is used to help users schedule appointments more efficiently. A SQL injection vulnerability exists in NodAPS 'search'. An attacker can exploit the vulnerability to gain access to sensitive database information...

CVE-2018-12533

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

CVE-2018-12533

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

CVE-2018-12533

CVE-2018-12533 affects Red Hat JBoss RichFaces 3.1.0–3.3.4, enabling unauthenticated attackers to inject EL expressions and execute arbitrary Java code via a /DATA/ path substring in a request containing a org.richfaces.renderkit.html.Paint2DResource$ImageData object (RF-14310). Public detail in ...

CVE-2018-12533

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

CVE-2018-12532: Improper Neutralization of Special Elements used in an Expression Language Statement

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...