Command Execution Vulnerability in Qiji Ops Fortress Server (CNVD-2019-21086)

Zhejiang Qiji Technology Co., Ltd. is a company mainly engaged in computer hardware and software, network products, technology development and other projects. A command execution vulnerability exists in the server side of the Qiji Operations and Maintenance Fortress, which can be exploited by an...

Command Execution Vulnerability in the mi***.php File of S-CMS Enterprise Website Builder System

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. S-CMS enterprise website builder system mi.php file there is a command execution vulnerability, an attacker can use the vulnerabilit...

Code execution vulnerability in zzzphp v1.6.6 backend (CNVD-2019-17282)

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.6, which can be exploited by attackers to gain control of the web server...

File Upload Vulnerability in EyouCms Backend

Eyou Content Management System EyouCms is developed by php + mysql a set of open source CMS dedicated to small and medium-sized enterprise website construction. EyouCms backend file upload vulnerability , attackers can use the vulnerability to obtain control of the web server...

File upload vulnerability in Baiheng network cms

Baiheng Networks cms uses php+mysql+bootstrap and other frameworks to develop the building system. Baiheng Networks cms has a file upload vulnerability that can be exploited by attackers to gain control of the web server...

A week in security (May 6 – 12)

Last week on Labs, we discussed what to do when you discover a data breach, how 5G could impact cybersecurity strategy, the top six takeaways for user privacy, vulnerabilities in financial mobile apps that put consumers and businesses at risk, and in our series about vital infrastructure, we...

CVE-2018-5409

The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the...

Wipro Attackers Have Operated Under the Radar for Years

New details are emerging in the April attack on systems consulting behemoth Wipro, which saw its network hacked and used for mounting attacks on a dozen of its customers. In a fresh analysis of the indicators of compromise IOCs, Flashpoint analysts said that the cyberattackers have actually been...

CVE-2019-11615

/fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability. A remote normal registered user can use this vulnerability to upload backdoor files to control the server...

File upload vulnerability in Acme cms us***.php

Acme CMS is a full-featured, PHP + Mysql architecture, multi-language, responsive display, suitable for personal website construction CMS building system. Aike CMS us.php file upload vulnerability, attackers can use the vulnerability to upload any file, to obtain server control...

CVE-2019-2725

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services. Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2019-2689

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

CVE-2019-2691

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Roles. Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2019-2614

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Replication. Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple...

Code injection

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Replication. Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2019-2685

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

CVE-2019-2691

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Roles. Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2019-2623

CVE-2019-2623 affects Oracle MySQL Server (subcomponent: Server: Options) with affected versions 8.0.15 and prior. The vulnerability allows a low-privileged attacker with network access via multiple protocols to cause a hang or frequent, repeatable crash of MySQL Server (complete DOS). The issue ...

CVE-2019-2627

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multip...

RATELIMITED: HTTP PUT method is enabled downloader.ratelimited.me

Summary: Found on HTTP PUT sites enabled on web servers. I tried testing to write the file / codelayer137.txt uploaded to the server using the PUT verb, and the contents of the file were then taken using the GET verb Steps To Reproduce: Request: PUT /codeslayer137.txt HTTP/1.1 Host:...