CVE-2018-9851

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '|' instead of '/' as a directory separator, in conjunction with a ".." sequence...

Gxlcms QY Arbitrary File Read Vulnerability

Gxlcms QY is an enterprise website creation system. A security vulnerability exists in the Lib\Lib\Action\Admin\TplAction.class.php file in Gxlcms QY version 1.0.0713. The vulnerability can be exploited by a remote attacker to read arbitrary files with the help of a changed pathname in an Admin-T...

Yahei-PHP Prober Cross-Site Scripting Vulnerability

Yahei-PHP Proberv is a tool for detecting server information such as server hard disk resources, memory usage, network card traffic, system load and IP. A cross-site scripting vulnerability exists in the proberv.php file in Yahei-PHP Proberv version 0.4.7. A remote attacker can exploit this...

Enhancesoft osTicket Arbitrary Password Reset Vulnerability

Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A security vulnerability exists in Enhancesoft osTicket versions prior to 1.10.2. A remote attacker can exploit the vulnerability to reset arbitrary passwords...

CVE-2018-0195

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

ArsenoL Cross-Site Scripting Vulnerability

ArsenoL is a suite of fictional software deployed on websites to publish words and their meanings. A cross-site scripting vulnerability exists in ArsenoL version 0.5. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

QQQ SYSTEMS cross-site scripting vulnerability

QQQ SYSTEMS is a set of CGI scripts for creating quiz pages. A cross-site scripting vulnerability exists in QQQ SYSTEMS version 2.24. A remote attacker can exploit this vulnerability to inject arbitrary web scripts...

Apache HTTPD Remote Security Bypass Vulnerability

Apache httpd is the U.S. Apache Apache Software Foundation, an open source HTTP server developed and maintained specifically for modern operating systems. A security vulnerability exists in Apache httpd versions 2.4.0 through 2.4.29. An attacker can exploit this vulnerability by sending a special...

ZZCMS user/licence_save.php file arbitrary file deletion vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in the user/licencesave.php file in ZZCMS version 8.2. The vulnerability can be exploited by a remote attacker to delete arbitrary files with the 'oldimg' parameter in an...

UBUNTU-CVE-2017-18242

The applydependentcoupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service out-of-bounds read via a crafted aac file...

Trend Micro Smart Protection Server(Standalone) Elevation of Privilege Vulnerability

Trend Micro Smart Protection Server Standalone is a server that provides smart protection from Trend Micro. A security vulnerability exists in Trend Micro Smart Protection ServerStandalone version 3.3 and earlier. A remote attacker could exploit the vulnerability to elevate privileges...

Mozilla Firefox Arbitrary Code Execution Vulnerability (CNVD-2018-07313)

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. An arbitrary code execution vulnerability exists in Mozilla Firefox. A remote user can create specially crafted content that, when loaded by the target user, will execute arbitrary code on the...

Microsoft Edge and ChakraCore Remote Memory Corruption Vulnerability (CNVD-2018-06698)

Microsoft Windows 10 is a next-generation cross-platform operating system from Microsoft.Edge is one of the browsers that comes with the system.ChakraCore is the core of an open-source JavaScript engine that is used in Edge, and can also be used as a stand-alone JavaScript engine. engine. A memor...

Microsoft ChakraCore Scripting Engine CVE-2018-0936 Remote Memory Corruption Vulnerability

Description Microsoft ChakraCore is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore...

QCMS cross-site scripting vulnerability (CNVD-2018-06392)

QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in QCMS version 3.0. A remote attacker can exploit this vulnerability by sending the 'title' parameter to the /guest/index.html URI to obtain a user cookie...

Quest DR Series Appliance Default Credentials (HTTP)

Quest DR Series Appliances are using known default credentials for the HTTP login. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

NetApp SnapCenter Information Disclosure Vulnerability

NetApp SnapCenter is a suite of applications from NetApp, Inc. that provide the ability to back up, validate, clone, and restore NetApp storage systems.NetApp SnapCenter Server is a server version... A security vulnerability exists in NetApp SnapCenter versions 2.0 through 3.0.1. A remote attacke...

Cisco Secure Access Control System Java Deserialization Vulnerability

The Cisco Secure Access Control System is a policy-based platform for enterprise access and network device management control. A Java deserialization vulnerability exists in the Cisco Secure Access Control System. A remote user can send a specially crafted serialized Java object to exploit this...

Polycom QDX 6000 Cross-Site Scripting Vulnerability

The Polycom QDX 6000 devices is a video conferencing endpoint device from Polycom. A cross-site scripting vulnerability exists in the Web application feature of the Polycom QDX 6000 devices. A remote attacker can exploit this vulnerability to execute arbitrary Javascript code in a user's web...

Micro Focus Operations Orchestration Software Denial of Service Vulnerability

Micro Focus Operations Orchestration Software is a suite of IT process automation solutions from Micro Focus UK. The solution automates the management of IT tasks, operations and processes, as well as enhances audit compliance by generating documentation and reporting capabilities. A denial of...