6325 matches found
XXE Injection Vulnerability in UsualToolCMS Frontend
UsualToolCMS UTCMS is an enterprise web content management system CMS based on PHP and MySQL. An XXE injection vulnerability exists in the frontend of UsualToolCMS. An attacker can exploit the vulnerability to remotely read arbitrary files on the server...
News Wrap: Steam Zero Day Disclosure Drama, Unix Utility Backdoor
Why did Valve-owner Steam say it made a “mistake” turning a researcher away from its bug bounty program? Who was behind a backdoor that was purposefully introduced into a utility utilized by Unix and Linux servers? And why is Facebook coming under fire for its “Clear History” feature? Threatpost...
The vulnerability of the coTURN server function, related to an error in the encoding of registration data, allows a hacker to gain access to the server under the authority of the administrator.
The vulnerability of the coTURN server function is related to an error in the encoding of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the server through the telnet port under the authority of the administrator...
Denial Of Service (DoS)
mysql is vulnerable to denial of service. An easy to exploit vulnerability allows a high privileged attacker to crash the server...
Denial Of Service (Dos)
mysql is vulnerable to denial of service. An easy to exploit vulnerability allows a high privileged attacker to crash the server...
Denial Of Service (DoS)
mysql is vulnerable to denial of service. An easily exploitable vulnerability allows a high privileged attacker to crash the server...
Denial Of Service (Dos)
mysql is vulnerable to denial of service. An easily exploitable vulnerability allows a high privileged attacker to crash the server...
Information disclosure
An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory, aka 'Remote Desktop Protocol Server Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1225...
mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2019)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...
mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multip...
mysql: Server: Connection Handling unspecified vulnerability (CPU Jan 2019)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection Handling. Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical...
mysql: Server: Connection unspecified vulnerability (CPU Jan 2019)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...
mysql: Server: PS unspecified vulnerability (CPU Apr 2019)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: PS. Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...
mysql: Server: FTS unspecified vulnerability (CPU Jul 2019)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: FTS. Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...
Design/Logic Flaw
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
CVE-2019-11581
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and...
Vulnerability in core server (CVE-2019-10209)
Memory disclosure in cross-type comparison for hashed subplan In a database containing hypothetical, user-defined hash equality operators, an attacker could read arbitrary bytes of server memory. For an attack to become possible, a superuser would need to create unusual operators. It is possible...
CVE-2019-14521
The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter...
Host Header Injection
invenio-app is vulnerable to host header injection. The attack exists because it only relies on APPALLOWEDHOSTS to whitelist allowed host headers, misconfiguring the web server to allow requests with any host header...