Ufo UFO-UAPWS suffers from SQL error reporting injection vulnerability (CNVD-2016-10771)

Ufo UFO-UAPWS Reporting System is an Internet solution for enterprises. A SQL reporting error injection vulnerability exists in UFIDA UFO-UAPWS. An attacker exploiting the vulnerability can view sensitive information, obtain database information, and cause information leakage...

SQL Injection Vulnerability in Type Parameters of Digital Campus Management System of Shanghai Pengda Computer System Development Co.

The digital campus system of Shanghai Pengda Computer System Development Co., Ltd. is a technology platform using .NET+SqlServer. NET+SqlServer technology platform. A SQL injection vulnerability exists in the Digital Campus Management System/Student/xsxk/MessageView.aspx page of Shanghai Pengda...

SQL Injection Vulnerability in id Parameter of Digital Campus Management System of Shanghai Pengda Computer System Development Co.

The digital campus system of Shanghai Pengda Computer System Development Co., Ltd. is a technology platform using .NET+SqlServer. SQL injection vulnerability exists in the /BG/ToDo/ToDoDetail.aspx and /BG/Txl/TxlDetail.aspx pages of the Digital Campus Management System of Shanghai Pengda Computer...

SQL Injection Vulnerability in Digital China Internet Behavior Management System Announce_Num Parameter

Digital China Internet Behavior Management System is an Internet behavior logging system that fully owns the network behavior analysis management system, integrating hardware and software architecture, behavior analysis engine, management and control policies, analyzing network activities in real...

IBM Maximo Asset Management Information Disclosure Vulnerability (CNVD-2016-09860)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. An information disclosure vulnerability exists in IBM Maximo Asset Management, which can be exploited by attackers to obtain sensitive information...

Cisco Host Scan HostScan Engine Cross-Site Scripting Vulnerability

Cisco Adaptive Security Appliances Web VPN is a set of modules for configuring Web VPN on ASA firewalls. A cross-site scripting vulnerability in the HostScan Engine in the Cisco Host Scan package used by Cisco Adaptive Security Appliances Web VPN allows remote attackers to exploit the vulnerabili...

DuxCms Content Management System user parameter SQL Injection Vulnerability

DuxCms is a PHP development, based on HMVC rules for small and medium-sized enterprises, companies, news, personal and other related industries, website content management. DuxCms content management system user parameters exist SQL injection vulnerability. Attackers can use the vulnerability to...

CVE-2016-5432

The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization RHEV Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files...

SQL Injection Vulnerability in the getInfo Interface Function of Jiusi OA System

Ninth OA system is the OA system to install, implement, learn, operate and maintain. A SQL injection vulnerability exists in the Ninth OA System. The lack of filtering of the 'getInfo' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the database...

XXE Vulnerability in Ninth OA System

Ninth OA system is the OA system to install, implement, learn, operate and maintain. Ninth OA system DocumentBuilder db = ex.newDocumentBuilder; Document doc = db.parserequest.getInputStream; XXE vulnerability exists. An attacker can read arbitrary files on the server and obtain sensitive...

PT-2016-7973

Name of the Vulnerable Software and Affected Versions libksba version 1.3.4 Description The issue is related to the allocation of an unproportionate amount of memory when parsing crafted certificates in libksba, which may lead to a denial of service DoS. Additionally, in libksba 1.3.4, the...

AVer Information EH6108H+ hybrid DVR Information Disclosure Vulnerability

The AVer Information EH6108H+ hybrid DVR VU is a hard disk recorder DVR product from Round Show AVer Information. An information disclosure vulnerability exists in the AVer Information EH6108H+ hybrid DVR. An attacker can exploit the vulnerability to obtain sensitive information...

Generalized SQL Injection Vulnerability in VOD Live Streaming System of Nanjing Suaxing Information Technology Development Co.

Nanjing Suya Star Information Technology Development Co., Ltd. is for the school distance education and campus entertainment on demand needs and the development of a set of application systems. A generic SQL injection vulnerability exists in the VOD on-demand live streaming system of Nanjing Suya...

SQL injection vulnerability in BlogManage/Resource/UserForResourceList.aspx page of Shanghai Hongyu Information Technology Co.

ECS ECS education site system is a general-purpose CMS program developed by Shanghai Hongyu Information Technology Co., Ltd. for schools, education and other site-building system. The product BlogManage/Resource/UserForResourceList.aspx page SQL injection vulnerability, an attacker registers an...

SQL injection vulnerability in zylr.jsp page kzh parameter of Beijing Tsinghua University Xinyang book retrieval system

The library system of Beijing Qingda Xinyang Technology Co., Ltd. is a set of library comprehensive business management network platform under the open Web platform using object-oriented programming technology, advanced technology, easy to share resources and remote maintenance. The product has a...

IBM Tivoli Storage Manager for Space Management Local Information Disclosure Vulnerability

IBM Tivoli Storage Manager is an ANSI SAN-compliant, scalable solution for discovering, monitoring, and managing enterprise SAN architecture components, as well as allocating and automating the manipulation of an enterprise's attached disk storage resources. A local information disclosure...

CVE-2016-0385

Buffer overflow in IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when HttpSessionIdReuse is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors...

Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2016-06910)

Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...

Red Hat QuickStart Cloud Installer (QCI) Local Information Disclosure Vulnerability

Red Hat QuickStart Cloud Installer QCI is a web-based GUI configuration cloud product. A local information disclosure vulnerability exists in Red Hat QuickStart Cloud Installer QCI. An attacker could exploit the vulnerability to obtain sensitive information that could be useful in launching furth...

SAP HANA Enterprise Security Bypass Vulnerability

SAP HANA is a high-performance real-time data analytics platform from SAP. The platform provides data query functions, users can directly query and analyze a large amount of real-time business data. A security bypass vulnerability exists in SAP HANA Enterprise, which can be exploited by attackers...