CLUSTERPRO X and EXPRESSCLUSTER X vulnerable to XML external entity injection (XXE)

Overview CLUSTERPRO X and EXPRESSCLUSTER X provided by NEC Corporation contain an XML external entity injection XXE vulnerability CWE-611. NEC Corporation reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and NEC Corporation coordinated under the Informatio...

INNEO Solutions INNEO Startup TOOLS 2018 M040 Path Traversal Vulnerability

INNEO Solutions INNEO Startup TOOLS 2018 M040 is an INNEO startup tool from INNEO Solutions, Germany. A path traversal vulnerability exists in INNEO Solutions INNEO Startup TOOLS 2018 M040 13.0.70.3804 and previous versions. An attacker can exploit this vulnerability to read arbitrary files on th...

Intranda Goobi Viewer Core Path Traversal Vulnerability

Intranda Goobi Viewer Core is a Web-based digital library system from Intranda, Germany. A path traversal vulnerability exists in Intranda Goobi Viewer Core versions prior to 4.8.3. A remote attacker could exploit this vulnerability to access files on the server...

CVE-2020-15124

In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive...

Directory Traversal Vulnerability in Intelligent Meter Collective Reading Management System of Qingdao Automation Instrumentation Co.

Intelligent meter cluster management system is an industrial control management system that controls statistics and manages some of the data in the energy industry. There is a directory traversal vulnerability in the Intelligent Meter Management System of Qingdao Automation Instrumentation Co.,...

Directory Traversal Vulnerability in MCMS

MCMS is a website building system of MINGFEI TECHNOLOGY CO. MCMS suffers from a directory traversal vulnerability. An attacker can exploit the vulnerability to read the contents of any file on the server...

GHSA-9H4G-27M8-QJRG Path Traversal in socket.io-file

All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join. It is possible to upload files to arbitrary...

Arbitrary File Read Vulnerability in CloudCare Inspection Information System

Guangzhou Daan Clinical Laboratory Center Co., Ltd. is a high-tech enterprise group engaged in professional medical services, public health services and related technical support services. YunKang test information system there are arbitrary file reading vulnerability, an attacker can exploit the...

Directory Traversal Vulnerability in Intelligent Meter Management System of Qingdao Automation Instrument Co.

Qingdao Automatic Instrumentation Co., Ltd. is a new joint-stock enterprise integrating R&D and manufacturing. There is a directory traversal vulnerability in the Intelligent Meter Collector Management System of Qingdao Automation Instrument Co., Ltd. that can be exploited by attackers to obtain...

Arbitrary File Read Vulnerability in WMCMS

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS arbitrary file reading vulnerability, an attacker can exploit the vulnerability to read files under the server...

Subrion CMS Cross-Site Request Forgery Vulnerability (CNVD-2020-32357)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site request forgery vulnerability exists in Subrion CMS version 4.2.1, which can be exploited by a remote...

The vulnerability of the building management software (management of access control, security systems, video surveillance, and automation) Andover Continuum System, related to the possibility of interference with XML data processing by the application, allows a intruder to gain access to the files in the application server’s file system.

The vulnerability of the building management software management of access control, security systems, video surveillance, and automation Andover Continuum System is related to the possibility of interference with XML data processing by the application. Exploiting this vulnerability can allow a...

SQL injection vulnerability in Heybbs micro community frontend us***.php file SQL injection

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. Heybbs micro-community front-end us.php file SQL injection SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

Arbitrary File Download Vulnerability in WMCMS

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS arbitrary file download vulnerability, attackers can use the vulnerability to download sensitive files under the server...

Arbitrary File Deletion Vulnerability in Fiyocms System

Fiyocms is a free and open source cms system for rapid development of personal and corporate websites and blogging systems. Fiyocms system has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete any file under the server...

Arbitrary File Deletion Vulnerability in WMCMS

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS arbitrary file deletion vulnerability , an attacker can exploit the vulnerability to delete any file under the server...

CVE-2020-10457

Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a dot-dot-slash sequence ../ via the POST parameter imgName for the new name and imgUrl for the current file to be renamed...

Arbitrary File Read Vulnerability in jpress

JPress a product developed using Java, similar to WordPress. Born to integrate the WeChat ecosystem, simple and easy to get started. Dedicated to creating an autonomous self-owned marketing platform for enterprises, using technology to help enterprises marketing cash. jpress there is an arbitrary...

Arbitrary File Download Vulnerability in ZrLog V2.1.1

ZrLog is a blogging program developed using Java. ZrLog V2.1.1 suffers from an arbitrary file download vulnerability, which can be exploited by an attacker to download any file on the server via a constructed path...

Unspecified Vulnerability in OpServices OpMon (CNVD-2020-14223)

OpServices OpMon is an IT infrastructure monitoring software from Brazil. A security vulnerability exists in OpServices OpMon. An attacker can exploit the vulnerability to read server files e.g. /etc/passwd...