Shenzhen with the world Technology Co., Ltd. station building system with ultraviolet access vulnerability

Shenzhen with the world technology limited company is a travel agency SaaS intelligent management system research and development, sales and the establishment of industry data center as one of the new Internet enterprises. Shenzhen with the world Technology Co., Ltd. building system there is an...

Jinja2 sandbox escape via string formatting

In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape. The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.formatmap method could be used to escape the sandbox. This...

Override access vulnerability in de*** module of LaySNS lightweight content community system of Wuhan ClassSen Technology

LaySNS is a lightweight, integrated content management and community interaction website management system based on ThinkPHP+Layui architecture. A vulnerability exists in the de module of the LaySNS lightweight content community system in Wuhan Classen Technology. The vulnerability stems from the...

CVE-2019-1010257

An Information Disclosure / Data Modification issue exists in article2pdfgetfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can ...

CVE-2019-1010257

An Information Disclosure / Data Modification issue exists in article2pdfgetfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can ...

Ultra-rights access vulnerability exists in DreamWalk OL

Four Thirty Nine Networks Corporation is an operator providing Internet leisure and entertainment game applications and information services. A vulnerability exists in override access to Dream Journey OL, which can be exploited by attackers to obtain information about other users...

Ocean Blue Rapid Website Builder System Exists Override Access Vulnerability

Ocean Blue rapid station-building system is a website building system developed by Shenzhen Ocean Blue Technology Co. Ocean Blue Rapid Website builder system has an override access vulnerability, which can be exploited by attackers to delete other people's account information...

Culture Unchained App Has Override Access Vulnerability

Culture Unchained App is a free e-reading application product. A vulnerability exists in Culture Read APP, which can be exploited by attackers to obtain information about other users...

Culture Unchained App Has Override Access Vulnerability

Culture Unchained App is a free e-reading application product. A vulnerability exists in Culture Read APP, which can be exploited by attackers to obtain information about other users...

Guizhou statistics release app has override access vulnerability

Guizhou statistics release app is a Bijie area set release of statistical information and participate in the questionnaire survey mobile client. Guizhou Statistics Release app has an override access vulnerability. An attacker can exploit this vulnerability to obtain sensitive information...

Discuz Frontend Override Login Vulnerability

Discuz is a general purpose community forum software system. There exists an override login vulnerability in the frontend of Discuz. The vulnerability is due to the administrator login background need account password, the vulnerability will not affect the background, the attacker may log in any...

BlogEngine.NET 3.3.6 - Directory Traversal Remote Code Execution

BlogEngine.NET 3.3.6 - Directory Traversal Remote Code Execution Exploit Title: BlogEngine.NET = 3.3.6 Directory Traversal RCE Date: 02-11-2019 Exploit Author: Dustin Cobb Vendor Homepage: https://github.com/rxtur/BlogEngine.NET/ Software Link:...

@antarctica/bas-style-kit (>=0.5.0-alpha, <=0.5.0), @antistatique/retraitespopulaires-styleguide (>=0.0.1, <=1.8.4) +153 more potentially affected by CVE-2016-10735 via bootstrap-sass (>=2.3.2, <=3.3.7)

bootstrap-sass NPM version =2.3.2, =0.5.0-alpha, =0.0.1, =0.0.1, =0.533.0, =8.0.0, =0.1.0, =2.0.2, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @opuscapita/oc-common-ui 8.3.3 and more Source cves: CVE-2016-10735 Source advisory: OSV:GHSA-4P24-VMCR-4GQJ...

Remote Code Execution Vulnerability in ThinkPHP 5.0.*

ThinkPHP is developed and maintained by the Shanghai Top Thinking Information Technology Co., Ltd. development and maintenance of the MVC structure of the open-source PHP framework. ThinkPHP 5.0. remote code execution vulnerability exists, the vulnerability is due to the framework in the processi...

WeiPHP 5.0beta frontend has an override access vulnerability

WeiPHP is an open source WeChat public platform development framework, can easily build a personal WeChat public account operation platform. WeiPHP5.0beta front-end has an override access vulnerability. The vulnerability stems from the user operation does not verify the identity, the attacker can...

Vulnerability of the Android APP of Hunan Provincial People's Government with Ultra-rights Access (CNVD-2019-01346)

Hunan Provincial People's Government Android APP is the mobile portal of Hunan Provincial Government information disclosure, with news news, matters inquiries, matters applications, office query, service evaluation, payment services, logistics services, material upload, online reservation, office...

Vulnerabilities in the ABC website building system of Beijing EWY Data Technology Co.

Beijing Yiwei Cloud Data Technology Co., Ltd. is an innovative enterprise focusing on providing Internet basic data services and data operation for small and medium-sized enterprises. Beijing Yiwei Cloud Data Technology Co., Ltd. station building ABC station building system there is an override...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

Kaspersky: Web protection component in Anti-Virus products family ignores HSTS security policy

Summary Kaspersky Internet Security seems to ignore the Strict-Transport-Security HTTP header. This allows Man-in-the-Middle attacks on websites that would normally be immune to them. The only requirement is the user confirming the certificate override, something that can be achieved by social...

Security update for ImageMagick (moderate)

This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage bsc1113064. Non-security issues fixed: - Improve import documentation bsc1057246. - Allow override system security policy bsc1117463. - asanbuild: build...