CVE-2020-25483

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

Command injection

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

Bubble Accelerator (Windows Client) Command Execution Vulnerability

Bubble Accelerator is an acceleration tool for games. Bubble Accelerator Windows client A command execution vulnerability exists. An attacker can exploit the vulnerability to remotely execute commands and gain server privileges...

Command Execution Vulnerability in Haozitong Cloud Conference PC Version

GoodVision Cloud Meeting for PC is a platform developed for video conferencing offices. A command execution vulnerability exists in GoodView Cloud Meeting PC Edition, which can be exploited by an attacker to gain control of the server...

CAD Quick Look - Editing Assistant pc client software has a command execution vulnerability

Quanta Technology Co., Ltd. is a listed software company, based on the field of construction engineering, centering on the whole life cycle of engineering projects, providing professional applications in the field of construction engineering as the core basic support, and value-added services suc...

Malicious Package

Overview All versions of plutov-slack-client contain malicious code. Upon installation the package opens a shell to a remote server. The package affects both Windows and nix systems. Recommendation Any computer that has this package installed or running should be considered fully compromised. All...

PT-2020-6346 · Schneider Electric · Communication Modules +3

Name of the Vulnerable Software and Affected Versions: Modicon M340 versions affected versions not specified Modicon Quantum versions affected versions not specified Modicon Premium Legacy versions affected versions not specified Communication Modules versions affected versions not specified...

Exploit for CVE-2018-2894

Weblogic CVE-2018-2894 CVE-2018-2894 0x01 前言 Oracle 7月更新中，修复了Weblogic Web Service Test Page中一处任意文件上传漏洞，Web Service Test Page 在“生产模式”下默认不开启，所以该漏洞有一定限制， 利用该漏洞，可以上传任意jsp文件，进而获取服务器权限。 0x02 漏洞环境 Ubuntu 16.04 https://github.com/vulhub/vulhub/blob/master/weblogic/CVE-2018-2894/ 执行如下命令，启动weblogic 12.2.1....

CVE-2020-15369

Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to gain access to the remo...

B-swiss 3 Digital Signage System 3.6.5 Backdoor Remote Code Execution

Summary Intelligent digital signage made easy. To go beyond the possibilities offered, b-swiss allows you to create the communication solution for your specific needs and your graphic charter. You benefit from our experience and know-how in the realization of your digital signage project...

Malicious Package in electron-native-notify

All versions of electron-native-notify contain malicious code. The package was part of a targeted attack to steal cryptocurrency wallet seeds and upload them to a remote server, effectively giving attackers access to users wallets. Recommendation Remove the package from your environment and follo...

CVE-2020-11991

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system...

Command Execution Vulnerability in Extreme CMS of Langfang Extreme Network Technology Co.

Extreme CMS is an open source content management system. Ltd. Extreme CMS has a command execution vulnerability that can be exploited by an attacker to gain access to the web server...

Command Execution Vulnerability in UCMS

UCMS is a simple web content management system. A command execution vulnerability exists in UCMS, which can be exploited by an attacker to gain administrative privileges on the server...

Memory Corruption Vulnerability in WPS Office Campus Edition of Zhuhai Kingsoft Office Software Co.

WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Office Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd, which can be exploited by attackers to gain administrative...

Command Execution Vulnerability in Empire CMS v7.5 Backend

EmpireCMS Empire Content Management System is an open source content management system CMS. A command execution vulnerability exists in the Empire CMS v7.5 backend, which can be exploited by an attacker to gain access to the web server...

PT-2020-3668

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server versions prior to the fixed version Description An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon...

TPshop open source mall management background Ueditor page file upload vulnerability

TPshop open source mall is developed with the latest version of ThinkPHP shop mall. TPshop open source mall management background Ueditor page file upload vulnerability. Attackers can use this vulnerability to upload webshell, get server privileges...

Arbitrary File Read Vulnerability in CLTPHP Open Source Edition

CLTPHP content management system is an efficient site-building PHP content management system , but also an open source CMS system . CLTPHP open source version of the existence of arbitrary file reading vulnerability , an attacker can exploit the vulnerability to read any file on the server...

File Upload Vulnerability in Enterprise Website Building System of Zibo Shining Network Technology Co. Ltd (CNVD-2020-50745)

Zibo Shining Network Technology Co., Ltd. enterprise station-building system a specialized enterprise station-building solutions for the product. There is a file upload vulnerability in the Zibo Shining Network Technology Co. An attacker can use the vulnerability to upload a webshell and gain...