Kliqqi CMS SQL Injection Vulnerability

Kliqqi CMS is a content management system CMS. A SQL injection vulnerability exists in Kliqqi CMS version 3.5.2. A remote attacker can exploit the vulnerability to view data in the database with the help of the 'randkey' parameter with the value AND SELECT FROM SELECTSLEEP5MBMY to potentially gai...

Discuz! DiscuzX cross-site scripting vulnerability (CNVD-2018-08776)

Discuz! DiscuzX is an online forum system. A cross-site scripting vulnerability exists in Discuz! DiscuzX X3.4 and previous versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of forum.php?mod=post&action=newthread...

HongCMS Cross-Site Request Forgery Vulnerability

HongCMS is an open source lightweight content management system CMS. A cross-site request forgery vulnerability exists in HongCMS version 3.0.0. A remote attacker can exploit this vulnerability to add an administrator account with the help of admin/index.php/users/save URI...

Oracle Access Manager Remote Vulnerability (CNVD-2018-09095)

Oracle Access Manager is the latest solution for centralized identity management and access control. A remote security vulnerability exists in the Oracle Access Manager component that can be exploited by an unauthenticated, remote attacker to compromise integrity, confidentiality, and availabilit...

Oracle WebCenter Sites Remote Vulnerability (April 2018 CPU)

The version of Oracle WebCenter Sites running on the remote host is affected by an unspecified flaw in the Sites component formerly FatWire Content Server that allows an remote attacker to impact confidentiality and integrity. Note that this issue only applies to versions 11.1.1.8.0, 12.2.1.2.0,a...

CVE-2018-1146

A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled the telnet session requires no password and provides root access...

Oracle Java SE Security Updates (apr2018-3678067) 03 - Linux

Oracle Java SE is prone to a remote unspecified security vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

MiniCMS Cross-Site Scripting Vulnerability

MiniCMS is a mini content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in MiniCMS version 1.10. A remote attacker can exploit this vulnerability by sending the 'sitelink' parameter to the mc-admin/conf.php file to execute commands...

BOSE SoundTouch Remote Control Vulnerability

The BOSE SoundTouch is a wireless speaker device from the American company BOSE. A security vulnerability exists in BOSE SoundTouch. A remote attacker could exploit this vulnerability with the help of a specially crafted website to achieve remote control...

CA Workload Control Center Arbitrary Code Execution Vulnerability

CA Workload Control Center is the GUI for CA Workload Automation AE. An arbitrary code execution vulnerability exists in CA Workload Control Center. A remote attacker could exploit this vulnerability to execute arbitrary code via a specially crafted HTTP request...

Microsoft Internet Explorer Scripting Engine Information Disclosure Vulnerability (CNVD-2018-08026)

Internet Explorer is a web browser from Microsoft. Microsoft Internet Explorer has a remote information disclosure vulnerability in the scripting engine's memory object handling, which can be exploited by an attacker to obtain sensitive information...

Armia Systems iScripts SonicBB Cross-Site Scripting Vulnerability

Armia Systems iScripts SonicBB is a PHP and MySQL based community forum building software package from Armia Systems, USA. The product includes features such as member registration, on-site search and custom configuration. A cross-site scripting vulnerability exists in Armia Systems iScripts...

CVE-2018-9851

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '|' instead of '/' as a directory separator, in conjunction with a ".." sequence...

Gxlcms QY Arbitrary File Read Vulnerability

Gxlcms QY is an enterprise website creation system. A security vulnerability exists in the Lib\Lib\Action\Admin\TplAction.class.php file in Gxlcms QY version 1.0.0713. The vulnerability can be exploited by a remote attacker to read arbitrary files with the help of a changed pathname in an Admin-T...

Yahei-PHP Prober Cross-Site Scripting Vulnerability

Yahei-PHP Proberv is a tool for detecting server information such as server hard disk resources, memory usage, network card traffic, system load and IP. A cross-site scripting vulnerability exists in the proberv.php file in Yahei-PHP Proberv version 0.4.7. A remote attacker can exploit this...

Enhancesoft osTicket Arbitrary Password Reset Vulnerability

Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A security vulnerability exists in Enhancesoft osTicket versions prior to 1.10.2. A remote attacker can exploit the vulnerability to reset arbitrary passwords...

CVE-2018-0195

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

QQQ SYSTEMS cross-site scripting vulnerability

QQQ SYSTEMS is a set of CGI scripts for creating quiz pages. A cross-site scripting vulnerability exists in QQQ SYSTEMS version 2.24. A remote attacker can exploit this vulnerability to inject arbitrary web scripts...

ArsenoL Cross-Site Scripting Vulnerability

ArsenoL is a suite of fictional software deployed on websites to publish words and their meanings. A cross-site scripting vulnerability exists in ArsenoL version 0.5. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Apache HTTPD Remote Security Bypass Vulnerability

Apache httpd is the U.S. Apache Apache Software Foundation, an open source HTTP server developed and maintained specifically for modern operating systems. A security vulnerability exists in Apache httpd versions 2.4.0 through 2.4.29. An attacker can exploit this vulnerability by sending a special...