Sentrifugo SQL Injection Vulnerability

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2. A remote attacker can exploit this vulnerability to...

idreamsoft iCMS server-side request forgery vulnerability (CNVD-2019-10138)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. The idreamsoft iCMS 7.0.11 suffers from a server-side request forgery vulnerability that originates from the 'remote' function in the app/spider/spidertools.class.php file that receives a DNS associated with a...

Remote Controller Removal Vulnerability in HOLLYWOOD LE5109L PLCs

HOLLIS Group is a professional automation company integrating R&D, production, sales and technical service. A remote controller removal vulnerability exists in the Hologic LE5109L PLC, where an attacker can construct specific modbus packets to remotely remove all program and configuration...

Oracle Database Server Java VM Component Remote Vulnerability

Oracle Database Server is a set of relational database management system of Oracle Oracle. The database management system provides data management, distributed processing and other functions.Java VM is one of the Java virtual machine components. A security vulnerability exists in the Java VM...

Remote Control Command Vulnerability in omron PLC SYSMAC CP1L

The omron PLC SYSMAC CP1L is a PLC from Omron. A remote control command vulnerability exists in the omron PLC SYSMAC CP1L, which can be exploited by an attacker to switch the PLC to monitor mode and then set and force writes to the PLC, as well as operate I/O points and auxiliary relays, and modi...

Remote Control Vulnerability in Hologic PLC LE5109L

HOLLIS Group is a professional automation company integrating R&D, production, sales and technical service. A remote control vulnerability exists in the Hologic PLC LE5109L, which can be exploited by an attacker to cause all output points of the PLC to go out by sending constructed packets that...

XnView Denial of Service Vulnerability (CNVD-2019-10272)

XnView is a multi-platform software that supports image viewing, conversion and editing. A denial of service vulnerability exists in XnView 2.45, which can be exploited by remote attackers to cause a denial of service via a specially crafted RLE file...

QCMS Cross-Site Scripting Vulnerability (CNVD-2019-10279)

QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in upload/System/Controller/backend/user.php in QCMS 3.0.1, which can be exploited by remote attackers to inject arbitrary web script or HTML...

Autonomic Controls Devices No Authentication (Telnet)

Per default, Autonomic Controls devices don SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:autonomiccontrols:device";...

Tenda D152 ADSL Cross-Site Scripting Vulnerability

Tenda D152 ADSL is a wireless router product from Tenda China. A security vulnerability exists in the Tenda D152 ADSL. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via a specially crafted SSID...

Cross site scripting

A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1...

CVE-2018-12483

OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscoveranalyser rzo GET parameter is concatenated to a string used in an exec call in the PHP code. Authentication is needed in order to exploit this vulnerabili...

Web Remote Viewer Default Credentials (HTTP)

Web Remote Viewer has the default username SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ASUS HG100 Command Execution Vulnerability

ASUS HG100 is a home smart monitoring device from ASUS. A command execution vulnerability exists in ASUS HG100 using firmware versions prior to 1.05.12. A remote attacker could exploit the vulnerability to execute commands...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-24614)

IBM Rational Quality Manager RQM is a collaborative, Web-based quality management solution from IBM. The program provides test planning and test evaluation management methods within the entire software development lifecycle, and the ability to share information, automation to accelerate the proje...

Google Chrome Omnibox URL Spoofing Vulnerability (CNVD-2018-18761)

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 68.0.3440.75. A remote attacker can exploit the vulnerability to forge URLs with the help of a specially crafted...

Oracle MySQL Server Remote Vulnerability (CNVD-2018-13748)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which the MySQL Server component is a database server component. A security vulnerability exists in Oracle MySQL Server. An attacker can exploit the vulnerability to cause MySQL Server to hang or cras...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2018-14089)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in WUZHI CMS version 4.1.0. A remote attacker can inject arbitrary Web script or HTML by sending the 'formcontent'...

Oracle Fusion Middleware Oracle WebLogic Server Component Remote Vulnerability (CNVD-2018-13563)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platform for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. Oracle WebLogic Server is one of the application server components for cloud and traditional...

joyplus-cms cross-site scripting vulnerability (CNVD-2018-17480)

joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in...