CVE-2019-11447: Unrestricted Upload of File with Dangerous Type

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content ...

jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using blaze classes. An attacker could use this flaw to execute arbitrary code...

Insecure Session Management

contao/core-bundle contains an insecure session management. The old opt-in tokens are not invalidated when a new token is confirmed...

Confirming an opt-in token does not invalidate previous opt-in tokens

More info at https://contao.org/en/news/security-vulnerability-cve-2019-10643.html...

Confirming an opt-in token does not invalidate previous opt-in tokens

More info at https://contao.org/en/news/security-vulnerability-cve-2019-10643.html...

Invalidating opt-in tokens

Date : 2019-04-09 CVEID : CVE-2019-10643 Description Security researcher Ali Razzaq has discovered that confirming an opt-in token does not invalidate previous opt-in tokens in Contao 4.7. Affected versions Contao 4.7 up to 4.7.2 Suggested solution Update to Contao 4.7.3...

baigo CMS Arbitrary Code Execution Vulnerability

baigo CMS is a PHP-based open source web content management system. An arbitrary code execution vulnerability exists in baigo CMS 2.1.1. The vulnerability stems from the BGSITENAME parameter with malicious code that can be written to the optbase.inc.php file. A remote attacker can exploit this...

CVE-2019-9226: Improper Neutralization of Input During Web Page Generation

An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the optbaseBGSITENAME parameter to the bgconsole/index.php?m=opt&c=request URI...

CVE-2019-7704

wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt...

Memory corruption

wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt...

CVE-2019-7704

wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt...

CVE-2019-7704

wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt...

CVE-2019-7704: Allocation of Resources Without Limits or Throttling

wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt...

CVE-2019-1000023

OPT/NET BV OPTOSS Next Gen Network Management System NG-NetMS version v3.6-2 and earlier versions contains a SQL Injection vulnerability in Identified vulnerable parameters: id, idaccesstype and idattraccess that can result in a malicious attacker can include own SQL commands which database will...

Cross site scripting

OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting XSS vulnerability in /js/libs/jstree/demo/filebrowser/index.php page. The "id" and "operation" GET parameters can be used to inject arbitrary JavaScript which is returned in the page's response that can result...

CVE-2019-1000023

CVE-2019-1000023 affects OPTOSS Next Gen Network Management System (NG-NetMS) v3.6-2 and earlier. The issue is a SQL Injection in vulnerable parameters id, id_access_type, and id_attr_access, allowing an attacker to inject and execute arbitrary SQL commands on the database. Exploitation is possib...

CVE-2019-1000023

OPT/NET BV OPTOSS Next Gen Network Management System NG-NetMS version v3.6-2 and earlier versions contains a SQL Injection vulnerability in Identified vulnerable parameters: id, idaccesstype and idattraccess that can result in a malicious attacker can include own SQL commands which database will...

CVE-2019-1000023: Improper Neutralization of Special Elements used in an SQL Command

OPT/NET BV OPTOSS Next Gen Network Management System NG-NetMS version v3.6-2 and earlier versions contains a SQL Injection vulnerability in Identified vulnerable parameters: id, idaccesstype and idattraccess that can result in a malicious attacker can include own SQL commands which database will...

CVE-2019-7151

A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt...

CVE-2019-7153

A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions in wasm/wasm-binary.cpp when calling wasm::WasmBinaryBuilder::getFunctionIndexName in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt...