TuziCMS v3.0 do***_pc*** has a command execution vulnerability

TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS v3.0 dopc has a command execution vulnerability that can be exploited by an attacker to gain control of the server...

Changsha Mito Information Technology Co. metinfo suffers from file upload vulnerability

metinfo is mainly used to build enterprise websites, using PHP+MySQL architecture, supporting SQLite database and so on. A file upload vulnerability exists in metinfo of Changsha Mito Information Technology Co. Ltd, which can be exploited by attackers to obtain server control privileges...

Command Execution Vulnerability in AC15 Upgrade Software of Shenzhen Jixiang Tengda Technology Co.(CNVD-2020-40766)

The AC15 upgrade software is manufactured by Shenzhen Jixiang Tengda Technology Co., Ltd. and features a built-in dual-core processor with DDR3 memory. The Shenzhen Jixiang Tengda Technology Co., Ltd AC15 Upgrade Software suffers from a command execution vulnerability that can be exploited by...

freerdp: Out-of-bounds write in interleaved.c

A flaw was found in FreeRDP between versions 1.0 and 2.0.0. An out-of-bounds memory write was found in the interleaved.c function which could allow an attacker to take over and control the RDP server, including data sent to the client. The highest threat from this vulnerability is to data...

Command Execution Vulnerability in CFCA Front Office Back Office Management System

CICC Financial Certification Center Limited is a national authoritative security certification body. A command execution vulnerability exists in the backend management system of CFCA's front-end, which can be exploited by an attacker to gain control of a web server...

Command Execution Vulnerability in Ocean CMS Backend (CNVD-2020-33132)

Ocean CMS is a web content management system based on PHP+MYSQL architecture that can run across platforms. A command execution vulnerability exists in the backend of Ocean CMS, which can be exploited by attackers to gain control of the web server...

File Upload Vulnerability in PHPOK of Shenzhen Kunshuo Technology Co., Ltd (CNVD-2020-33151)

PHPOK is a set of PHP language and MySQL database written using the enterprise website construction system. Ltd. PHPOK has a file upload vulnerability that can be exploited by attackers to gain control of the web server...

File Upload Vulnerability in 115CMS

115CMS is an open source content management system developed with ThinkPHP framework. 115CMS has a file upload vulnerability that can be exploited by attackers to gain control of a web server...

CVE-2020-6250

SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the adjacent network, to read system administrator password leading to Information Disclosure. This could help the attacker to read/write any data and even stop t...

File renaming vulnerability in the background of YidaCMS Yida building system (CNVD-2020-27481)

YidaCMS website management system is a simple, practical and efficient website builder. YidaCMS YidaCMS website builder system backend file renaming vulnerability, an attacker can exploit the vulnerability to obtain control of the server...

CVE-2020-2884

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to...

PT-2020-2528 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP,...

File Upload Vulnerability in Swordfish Forum v1.5.0

Swordfish Forum is a bbs forum system officially and publicly released by Catfish CMS. Swordfish Forum v1.5.0 has a file upload vulnerability that can be exploited by attackers to gain control of the web server...

U.S. Dept Of Defense: [█████████] Administrative access to Oracle WebLogic Server using default credentials

Hello. I discovered an Oracle WebLogic Server and because of weak credentials managed to login as administrator, which led to complete server takeover...

Centreon 19.10.5 - (Pollers) Remote Command Execution Exploit

Exploit for php platform in category web applications Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution Exploit Author: Omri Baso, Fabien Aunay Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7.7...

Centreon 19.10.5 - Pollers Remote Command Execution

Centreon 19.10.5 - Pollers Remote Command Execution Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution Date: 2020-01-27 Exploit Author: Omri Baso, Fabien Aunay Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested...

Centreon 19.10.5 Remote Command Execution

Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution Date: 2020-01-27 Exploit Author: Omri Baso, Fabien Aunay Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7.7 CVE : - Centreon 19.10.5 Remote Comma...

Centreon 19.10.5 - 'Pollers' Remote Command Execution

Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution Date: 2020-01-27 Exploit Author: Omri Baso, Fabien Aunay Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7.7 CVE : - Centreon 19.10.5 Remote Comma...

CVE-2020-2546

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Application Container - JavaEE. Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

PT-2020-1528 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0 through 12.1.3.0.0 Description: The issue is related to insufficient access control in the Application Container - JavaEE component of Oracle WebLogic Server, allowing an unauthenticated attacker wit...