CVE-2018-15389

A vulnerability in the install function of Cisco Prime Collaboration Provisioning PCP could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. The vulnerability is due to a hard-coded...

HPE Integrated Lights-Out 3, 4 and 5 Information Disclosure Vulnerabilities

HPE Integrated Lights-Out iLO 3, 4, and 5 are all embedded server management technologies from Hewlett Packard Enterprise HPE that monitor and maintain server operations, remotely control servers, and more through an integrated remote management port. An information disclosure vulnerability exist...

HPE Integrated Lights-Out 5 Arbitrary Code Execution Vulnerability

HPE Integrated Lights-Out iLO 3, 4, and 5 are all embedded server management technologies from Hewlett Packard Enterprise HPE that monitor and maintain server operations, remotely control servers, and more through an integrated remote management port. A security vulnerability exists in HPE iLO 3,...

Denial of service

A potential remote denial of service security vulnerability has been identified in HPE Integrated Lights Out 4 prior to v2.60 and iLO 5 for Gen 10 servers prior to v1.30...

IBM Business Process Manager SQL Injection Vulnerability

IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A SQL injection vulnerability exists in IBM BPM...

PHP Apache2 Component Cross-Site Scripting Vulnerability

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language is primarily used for web development and supports a variety of databases and operating systems.Apache2 is one of the HTTP server components. A cross-site...

DonLinkage SQL Injection Vulnerability

DonLinkage is a locator program. A SQL injection vulnerability exists in the /pages/proxy/php.php and /pages/proxy/add.php files in DonLinkage version 6.6.8. A remote attacker can exploit this vulnerability with specially crafted input to obtain information from the database...

CVE-2018-17088

The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03473)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4, which c...

CScms Cross-Site Scripting Vulnerability

CScms is a content management system CMS developed on a CI framework. A cross-site scripting vulnerability exists in the \upload\plugins\sys\Install.php file in CScms version 4.1. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML by using the site name...

Google Chrome Skia heap buffer overflow vulnerability (CNVD-2018-22399)

Google Chrome is a web browser developed by Google, Inc. Skia is an open source 2D graphics library that provides common APIs that work on a variety of hardware and software platforms. A heap buffer overflow vulnerability exists in Skia in versions prior to Google Chrome 63.0.3239.84. A remote...

HDCMS v2.0 suffers from SQL injection vulnerability (CNVD-2018-19306)

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. HDCMS v2.0 version has a SQL injection vulnerability, which can be exploited by remote attackers to obtain sensitiv...

Heap overflow

An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2encodepacket in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact...

CVE-2018-16376

An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2encodepacket in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact...

PT-2018-12912 · Github · Libfsclfs

Name of the Vulnerable Software and Affected Versions: libfsclfs versions prior to 2018-07-25 Description: The issue allows remote attackers to cause a heap-based buffer over-read via a crafted clfs file. This is due to a problem in the libfsclfs block read function in libfsclfs block.c. The vend...

Sentrifugo SQL Injection Vulnerability

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2. A remote attacker can exploit this vulnerability to...

idreamsoft iCMS server-side request forgery vulnerability (CNVD-2019-10138)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. The idreamsoft iCMS 7.0.11 suffers from a server-side request forgery vulnerability that originates from the 'remote' function in the app/spider/spidertools.class.php file that receives a DNS associated with a...

Remote Controller Removal Vulnerability in HOLLYWOOD LE5109L PLCs

HOLLIS Group is a professional automation company integrating R&D, production, sales and technical service. A remote controller removal vulnerability exists in the Hologic LE5109L PLC, where an attacker can construct specific modbus packets to remotely remove all program and configuration...

Oracle Database Server Java VM Component Remote Vulnerability

Oracle Database Server is a set of relational database management system of Oracle Oracle. The database management system provides data management, distributed processing and other functions.Java VM is one of the Java virtual machine components. A security vulnerability exists in the Java VM...

Remote Control Command Vulnerability in omron PLC SYSMAC CP1L

The omron PLC SYSMAC CP1L is a PLC from Omron. A remote control command vulnerability exists in the omron PLC SYSMAC CP1L, which can be exploited by an attacker to switch the PLC to monitor mode and then set and force writes to the PLC, as well as operate I/O points and auxiliary relays, and modi...