CVE-2018-0278

A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensitive data about the system. The vulnerability is due to improper cross-origin domain protections for the WebSocket protocol. An attacker could exploit this...

RATELIMITED: Local File Download

Summary: This bug affects suuport.ratelimited.me and can be used by attackers to download local file from your servers including your emails, and files uploaded by your admins and other users. Description: While starting a conversation with your support agent, I noticed an option to upload a file...

CVE-2018-10522

In CMS Made Simple CMSMS through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP filegetcontents function...

Uber: Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sg

lioncityrentals.com.sg employed a Wordpress installation that possessed a vulnerable plugin, Formidable Forms, which was vulnerable to reflected XSS, and exposed sensitive form data. Thanks again for the report, @healdb! This was the first bug I ever found that exposed a large amount of PII, than...

SQL Injection Vulnerability in Enterprise Website Building System of Zaozhuang Frontier Technology Co.

Zaozhuang Frontier Technology Co., Ltd. is engaged in software technology services. A SQL injection vulnerability exists in the enterprise website building system of Zaozhuang Frontier Technology Co. An attacker can exploit the vulnerability to obtain sensitive database information...

Cleartext Transmission of Sensitive Information via HTTP

The host / application transmits sensitive information username, passwords in cleartext via HTTP. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2018-8719

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

CVE-2017-1524

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request that could be used to aid future attacks. IBM X-Force ID: 129970...

CVE-2017-0935

Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator read-only account could escalate privileges to admi...

CVE-2017-0934

Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator read-only account could escalate privileges to admin...

SQL Injection Vulnerability in Vanguard Digitizing System

Vanguard Digital Technology Inc. provides web animation, graphic visual design, online advertising and marketing, and multimedia CD-ROM production services. A SQL injection vulnerability exists in the Vanguard Digital Web Building System. An attacker can exploit the vulnerability to obtain...

NiuShop B2C Single Merchant Mall System suffers from SQL Injection Vulnerability

NiuShop B2C single merchant mall system is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. NiuShop B2C single merchant mall system SQl injection vulnerability, attackers can use the vulnerability to obtain sensitive...

SQL Injection Vulnerability in Frontend of gxlcmsqy System

GxlcmsQY system is a simple program tailored for business users. A SQL injection vulnerability exists in the frontend of the gxlcmsqy system. An attacker can exploit this vulnerability to obtain sensitive database information...

Wenzhou Qiaoyu Technology Co., Ltd. station building system SQL injection vulnerability

Wenzhou Qiaoyu Technology Co., Ltd. is a focus on high-quality website construction, micro-site development, network marketing services SEO optimization as one of the innovative level of the company. Wenzhou Qiaoyu Technology Co., Ltd. website building system SQL injection vulnerability, attacker...

SQL Injection Vulnerability in Website Building System of Tianjin Qixiang Technology Co.

Tianjin Enterprise Xiang Technology Co., Ltd. is a collection of network technology services and enterprise e-commerce and communication network services as one of the technology-based enterprises. Specializing in Baidu bidding, Baidu promotion, website construction, seo optimization, 400...

CVE-2018-8712

An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data...

CVE-2016-0275

IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM for Corporate Payment Services CPS for...

SQL Injection Vulnerability in iCMS v7.0.7 apps.admincp.php Page

iCMS is a free, clean, efficient, and useful PHP content management system. iCMS v7.0.7 has a SQL injection vulnerability in the apps.admincp.php page. The vulnerability stems from the orderby parameter being brought into the database for execution without any processing. An attacker can exploit...

PT-2018-10010

Name of the Vulnerable Software and Affected Versions oVirt versions 4.1.x through 4.1.8 Description A vulnerability was discovered where the combination of Enable Discard and Wipe After Delete flags for VM disks could cause a disk to be incompletely zeroed when removed from a VM. This could...

SQL Injection Vulnerability in Website Building System of SHENYI TECHNOLOGY GROUP LIMITED

SHENYI TECHNOLOGY GROUP LIMITED is a comprehensive service-oriented enterprise pioneering website construction and network application services, mobile APP development, big data mining, cloud computing, Internet of Things, smart home, intellectual property agency, investment and financing service...