SQL Injection Vulnerability in Ne*** Page of Arctic Technology Website Builder System

Arctic Technology is mainly engaged in website construction, network promotion and enterprise WEB application team, is committed to enterprises, individuals, associations and organizations to provide website planning, construction, network maintenance and promotion services. SQL injection...

keycloak: verify-token-audience support is missing in the NodeJS adapter

A flaw was found in Keycloak, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

SQL Injection Vulnerability in Personnel Payroll System of School Worry Free Software Technology Co. Ltd (CNVD-2020-45140)

School Worry-free Software Technology Co., Ltd. is a high-tech development team engaged in the research and system development of educational software teaching applications. A SQL injection vulnerability exists in the personnel payroll system of SchoolWorryFree Software Technology Limited, which...

CVE-2020-12012

Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13, and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 have hard-coded administrative account credentials f...

CVE-2020-12008

Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order information with an order entry system. This could allow an attacker with network access to view sensitive data including PHI...

SQL injection vulnerability in deituiCMS (CNVD-2020-45161)

deituiCMS is a PHP-based open source content management system. A SQL injection vulnerability exists in deituiCMS, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in Hubei Guosheng Technology Co.

Hubei Guosheng Technology Co., Ltd, is a company specializing in website construction, small program mall, micro distribution system and other services. Ltd. website building system has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the...

SQL Injection Vulnerability in Beijing Jinpan Library Refined Management Platform

JINPAN Library Refined Management Platform consists of the management terminal of C/S architecture and the user terminals of C/S and B/S, covering four major functional modules, such as reading room management, training room management, readers' management, meeting check-in management and open...

PT-2020-14372 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to the use of GET request method with sensitive query strings for /cnr requests. This could potentially expose sensitive information. Recommendations: F...

PT-2020-14371 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to the use of GET request method with sensitive query strings for /registerCpe requests. This can potentially expose sensitive information...

SQL injection vulnerability in the wa***.aspx page of Qixing Exam System Exam Candidate Side at Shanghai Tsuenlu Software Development Studio.

Exam System Exam is a compact exam system for internal corporate use for employee exams. Shanghai Tsuen Road Software Development Studio Qixing Exam System Exam candidate side wa.aspx page there is a SQL injection vulnerability, an attacker can use this vulnerability to obtain sensitive informati...

Shanghai Bugu Network Technology Co., Ltd. website building system has SQL injection vulnerability

Shanghai Bugu Network Technology Co., Ltd. is a professional enterprise informationization and e-commerce solution expert. Shanghai Bugu Network Technology Co., Ltd. website building system SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

CVE-2020-4341

IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178181...

CVE-2020-4327

IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 177599...

XSS Vulnerability in HulaCWMS

HulaCWMS is developed on ThinkPHP5 framework and includes all the features of ThinkPHP5. HulaCWMS has an XSS vulnerability that can be exploited by an attacker to obtain sensitive information such as user cookies...

Unspecified Vulnerability in Mattermost Mobile Apps (CNVD-2020-35186)

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A security vulnerability exists in Mattermost Mobile Apps prior to version 1.26.0, which can be exploited by an attacker to obtain sensitive information due to the program's failure to clear cookie data after a user log...

SQL Injection Vulnerability in XSLCMS fe***.php Page

New Force Content Management System XSLCMS is a set of web content management system specialized for enterprise website construction. A SQL injection vulnerability exists in the XSLCMS fe.php page. An attacker can exploit the vulnerability to obtain sensitive database information...

ForU CMS suffers from SQL injection vulnerability (CNVD-2020-41225)

ForU CMS is an open source website management system. ForU CMS suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in XSLCMS ab***.php Page

New Force Content Management System XSLCMS is a set of web content management system specialized for enterprise website construction. A SQL injection vulnerability exists in the XSLCMS ab.php page. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2020-10782

An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is t...