Joomla! cross-site scripting vulnerability (CNVD-2019-14555)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in the Global Configuration textfilte...

Denial Of Service (DoS)

collectd is vulnerable to denial of service DoS attacks. The vulnerability exists as an incorrect interaction of the parsepacket and parsepartsignsha256 functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service infinite loop of a collectd instance...

OpenSSH Access Restriction Bypass Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers maintained by the OpenBSD Project Group. The tools are an open source implementation of the SSH protocol that supports encryption of all transmissions to effectively block eavesdropping, connection...

Dolibarr SQL Injection Vulnerability (CNVD-2019-00725)

Dolibarr is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A SQL injection vulnerability exists in the user/card.php file in...

FROG CMS Cross-Site Scripting Vulnerability (CNVD-2019-00385)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A cross-site scripting vulnerability exists in FROG CMS version 0.9.5, which can be exploited by a remot...

Apache CouchDB < 2.3.0 Remote Privilege Escalation Vulnerability - Windows

CouchDB is prone to a remote privilege escalation vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:couchdb";...

DamiCMS Arbitrary File Read Vulnerability

DamiCMS is a content management system CMS for building websites quickly. A security vulnerability exists in DamiCMS version 6.0.1. A remote attacker can exploit the vulnerability by sending a specially crafted request admin.php?s=Tpl/Add/id to read arbitrary files...

Kirby Cross-Site Scripting Vulnerability (CNVD-2019-03334)

Kirby is a document-based content management system CMS. A cross-site scripting vulnerability exists in Kirby version 2.5.12. The vulnerability can be exploited by a remote attacker to upload SVG files using the "site files" Add option...

Epic Games Launcher Code Execution Vulnerability

Epic Games Launcher is a game launcher from Epic Games USA. A code execution vulnerability in the handles used for the com.epicgames.launcher protocol in versions of Epic Games Launcher prior to 8.2.2 can be exploited by a remote attacker to execute arbitrary code...

Pocsuite v2.0.8 - Remote Vulnerability Testing Framework Developed By The Knownsec Security Team

Pocsuite is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec Security Team. It comes with a powerful proof-of-concept engine, many niche features for the ultimate penetration testers and security researchers. How to use Pocsuite wit...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-03526)

Craft CMS is a content management system CMS for developers and content managers. A cross-site scripting vulnerability exists in the /admin-panel-path/index.php?p=admin/actions/entries/save-entry URL in Craft CMS version 3.0.25. A remote attacker can exploit this vulnerability to inject arbitrary...

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A Cross-Site Scripting Vulnerabilities

TOSHIBA Home Gateway HEM-GW26A and TOSHIBA Home Gateway HEM-GW16A are both home gateway products from Toshiba Japan. A cross-site scripting vulnerability exists in TOSHIBA Home Gateway HEM-GW26A version 1.2.9 and earlier and TOSHIBA Home HEM-GW16A version 1.2.9 and earlier, which can be exploited...

DoorGets Directory Traversal Vulnerability

doorGets is a content management system CMS. The system supports multiple languages, and system backups and theme changes, etc. A security vulnerability exists in doorGets version 7.0. A remote attacker can exploit the vulnerability to write arbitrary files...

Micro Focus NetIQ iManager Cross-Site Scripting Vulnerability

Micro Focus NetIQ iManager is a WEB-based application from Micro Focus UK. The program can manage, configure eDirectory objects using wireless devices. A cross-site scripting vulnerability exists in Micro Focus NetIQ iManager versions prior to 3.1 SP2, which can be exploited by remote attackers t...

Mozilla Firefox Unauthorized Access Vulnerability (CNVD-2018-25864)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 64. A remote attacker can exploit this vulnerability to load WebExtension content scripts to about: pages, which could...

Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07234)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the EditCurrentPresentSpace.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker to inject arbitrary code with the help of th...

SQL Injection Vulnerability in HuCart aj***_ex***.php Page

HuCart HuCart is an open source enterprise building system. HuCart 5.7.4 version ajex.php page SQL injection vulnerability , remote attackers can exploit the vulnerability to obtain database sensitive information...

CVE-2018-7114

HPE Intelligent Management Center IMC prior to IMC PLAT 7.3 E0605P06 is vulnerable to remote buffer overflow in dbman leading to code execution. This problem is resolved in IMC PLAT 7.3 E0605P06 or subsequent versions...

PYSEC-2018-12

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

PowerDNS DNSDist Data Injection Vulnerability

PowerDNS DNSDist is a load balancer from the Dutch company PowerDNS that shunts traffic to different servers to provide optimal performance for users. A security vulnerability exists in PowerDNS DNSDist versions prior to 1.3.3. A remote attacker can exploit the vulnerability with the help of...