TSiteBuilder SQL Injection Vulnerability

TSiteBuilder is a set of tools for building websites, mainly for creating HTML-based websites. A SQL injection vulnerability exists in TSiteBuilder version 1.0. A remote attacker can exploit the vulnerability by sending the 'id' parameter to the /site.php, /pagelist.php, or /pagenew.php files to...

Google Chrome for Mac, Windows and Linux Security Bypass Vulnerability

Google Chrome for Mac, Windows and Linux is a web browser developed by Google, Inc. for the Mac, Windows and Linux platforms. A security vulnerability exists in versions of Google Chrome prior to 64.0.3282.119 for Windows, Mac and Linux platforms, which stems from the program's failure to...

Google Chrome for Mac, Windows and Linux Competitive Conditions Vulnerability

Google Chrome for Mac, Windows and Linux is a web browser developed by Google, Inc. for the Mac, Windows and Linux platforms. A competitive conditions vulnerability exists in versions of Google Chrome prior to 64.0.3282.119 for Windows, Mac and Linux based platforms. A remote attacker could explo...

SUSE SLES11 Security Update : clamav (SUSE-SU-2018:0254-1)

This update for clamav fixes the following issues : - Update to security release 0.99.3 bsc1077732 - CVE-2017-12376 ClamAV Buffer Overflow in handlepdfname Vulnerability - CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability - CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument...

Red Hat 389-ds-base Authentication Bypass Vulnerability

Red Hat 389-ds-base is an American Red Hat package that includes a Linux directory server and a server administration command-line program. A security vulnerability exists in Red Hat 389-ds-base, which arises from a failure of the program to properly handle internal hash comparison operations. A...

Mozilla Firefox WebCrypto Out-of-Bounds Write Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. WebCrypto is one of the encryption components. A security vulnerability exists in the 'DoCrypt' function of WebCrypto in versions of Mozilla Firefox prior to 58. A remote attacker could exploit this...

CVE-2017-16605

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-16593

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

NetGain Enterprise Manager Directory Traversal Vulnerability

Netgain Enterprise Manager is a suite of IT asset monitoring and management software from NetGain Systems, Singapore. A directory traversal vulnerability exists in the org.apache.jsp.u.jsp.restore.del005fdojsp servlet in NetGain Enterprise Manager, which originates from a process that fails to...

Advantech WebAccess Arbitrary File Upload Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An arbitrary file upload vulnerability exists in versions ...

WordPress WPGlobus plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.WPGlobus plugin is used in one of the plugin used to create a multi-language blog. A cross-site scripting vulnerabili...

WordPress read-and-understood plugin cross-site scripting vulnerability (CNVD-2018-01260)

WordPress is the WordPress Software Foundation of a set of PHP language development of the blogging platform, the platform supports PHP and MySQL server set up a personal blog site. read-and-understood plugin is the use of one of the use of the document reading plugin . A cross-site scripting...

Piwigo cross-site scripting vulnerability (CNVD-2018-04285)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in Piwigo version 2.8.2. A remote attacker can exploit this vulnerability to...

Exiv2 'Exiv2::Jp2Image::readMetadata' function denial of service vulnerability

Exiv2 is a set of C++ libraries and command line applications for managing image metadata by software developer Andreas Huggel, which provides fast and easy reading and writing of image metadata in a variety of EXIF, IPTC and XMP formats. A security vulnerability exists in the...

b2evolution PHP Code Execution Vulnerability

b2evolution is a PHP and MySQL based blogging software developed by software developer Francois Planque. A PHP code execution vulnerability exists in the basic installation functionality of b2evolution versions 6.6.0 through 6.8.10. An attacker can exploit this vulnerability to execute PHP code...

Flir Brickstream Sensors Incorrect Access Control Vulnerability (Aug 2018) - Active Check

Flir Brickstream Sensor is prone to an incorrect access control vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Tripwire IP360 VnE Manager Security Bypass Vulnerability

The Tripwire formerly known as nCircle IP360 VnE Manager is an IT asset management appliance from Tripwire USA. A security vulnerability exists in the RPC service in Tripwire IP360 VnE Manager version 7.2.2 prior to 7.2.6. A remote attacker can exploit the vulnerability with the help of specially...

Valve Steam Link Unspecified Vulnerability

The Valve Steam Link is a Steam online gaming device from Value Software in the United States. A security vulnerability exists in Valve Steam Link. A remote attacker can exploit this vulnerability by guessing the 24-bit MAC address and attempting to log in with root privileges to gain access...

Dolibarr ERP/CRM SQL Injection Vulnerability (CNVD-2018-01641)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A SQL injection vulnerability exists in the comm/multiprix.php...

PT-2017-15083 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: The issue allows remote attackers to obtain sensitive information by making direct requests to .tpl.php files, which are not blocked. Recommendations: For version 6.0.4, consider restricting access ...