4669 matches found
Sales & Company Management System Cross-Site Request Forgery Vulnerability
Sales & Company Management System SCMS is a sales and company management system. The system includes features such as customer management, product management and tax management. A cross-site request forgery vulnerability exists in the member/memberemail.php?action=edit URI in SCMS 2018-06-06 and...
CVE-2018-19923
An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is member/memberemail.php?action=edit CSRF...
CVE-2018-19925
An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. It has SQL injection via the member/memberorder.php type parameter, related to the Ostate parameter...
CVE-2018-19923
CVE-2018-19923 affects Sales & Company Management System (SCMS) up to 2018-06-06, with a Cross-Site Request Forgery (CSRF) in member/member_email.php?action=edit. Red Hat/CNVD/NVD entries corroborate the issue. CVSS details: CVSSv3 base score 8.8 (HIGH) with network access, user interaction requi...
CVE-2018-19923: Cross-Site Request Forgery (CSRF)
An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is member/memberemail.php?action=edit CSRF...
CVE-2018-19925: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. It has SQL injection via the member/memberorder.php type parameter, related to the Ostate parameter...
PT-2018-15169
Name of the Vulnerable Software and Affected Versions Sales & Company Management System SCMS versions prior to 2018-06-06 Description The issue is related to SQL injection via the type parameter in the "member/member order.php" endpoint, specifically involving the O state parameter. Recommendatio...
PT-2018-15167
Name of the Vulnerable Software and Affected Versions Sales & Company Management System SCMS versions prior to 2018-06-06 Description An issue was discovered in the system, where there is a CSRF vulnerability in the member email.php file, specifically when the action parameter is set to edit...
CVE-2018-19621
server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...
Cross site request forgery (csrf)
server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...
ShowDoc Cross-Site Request Forgery Vulnerability
ShowDoc is an online document sharing tool. A cross-site request forgery vulnerability exists in server/index.php?s=/api/teamMember/save URL in ShowDoc version 2.4.2. A remote attacker can exploit this vulnerability to add a new user to a team...
WordPress Ultimate Member plugin <= 2.0.32 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found in WordPress Ultimate Member plugin versions = 2.0.32. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.33...
Ultimate Member < 2.0.33 - Cross-Site Request Forgery (CSRF)
According to the change log: "Fixed AJAX vulnerabilities"...
S-CMS PHP SQL Injection Vulnerability
S-CMS PHP is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in the member/membernews.php file in S-CMS PHP version 1.0, which can be exploited by remote attackers to execute SQL commands with the help of the 'type' parameter...
Sql injection
S-CMS PHP 1.0 has SQL injection in member/membernews.php via the type parameter aka the $Ntype field...
CVE-2018-18887
S-CMS PHP 1.0 has SQL injection in member/membernews.php via the type parameter aka the $Ntype field...
CVE-2018-18887: Improper Neutralization of Special Elements used in an SQL Command
S-CMS PHP 1.0 has SQL injection in member/membernews.php via the type parameter aka the $Ntype field...
PT-2018-14708
Name of the Vulnerable Software and Affected Versions S-CMS PHP version 1.0 Description The issue is related to SQL injection in the member/member news.php file via the type parameter, also referred to as the $N type field. Recommendations For S-CMS PHP version 1.0, consider restricting access to...
kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group an...